CVE-2025-26695
10.03.2025, 19:15
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability affects Thunderbird < 136 and Thunderbird < 128.8.Enginsight
| Vendor | Product | Version |
|---|---|---|
| mozilla | thunderbird | 𝑥 < 128.8.0 |
| mozilla | thunderbird | 129.0 ≤ 𝑥 < 136.0 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| thunderbird |
|