SMTP and POP3 response injection when using STARTTLS
Summary
| CVE | CVE-2026-126135 |
|---|---|
| State | PUBLISHED |
| Assigner | mozilla |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-10 19:21:14 UTC |
| Updated | 2026-11-10 21:19:27 UTC |
| Description | If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as if they had been received from the server over the encrypted connection. This could be used to make Thunderbird report a different outcome for sending or fetching mail, and to show attacker-controlled text in error messages. The encrypted connection itself was not compromised, and credentials were not exposed. Connections using SSL/TLS instead of STARTTLS were not affected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Mozilla | Thunderbird | unaffected 153.7 153.* rpm | Not specified |
| CNA | Mozilla | Thunderbird | unaffected 160 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bugzilla.mozilla.org/show_bug.cgi | [email protected] | bugzilla.mozilla.org | |
| www.mozilla.org/security/advisories/mfsa2026-128 | [email protected] | www.mozilla.org | |
| www.mozilla.org/security/advisories/mfsa2026-129 | [email protected] | www.mozilla.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Ibrahim Alghamdi (en)
There are currently no legacy QID mappings associated with this CVE.