CVE-2026-118179 Request forgery via news: links
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118179?
CVE-2026-118179 is a vulnerability in Mozilla Thunderbird, published on 27 Oct 2026.
Official description
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Which versions are affected by CVE-2026-118179?
How do I fix CVE-2026-118179?
No fix has been published for CVE-2026-118179 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118179 being exploited?
There is no known exploitation of CVE-2026-118179 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-118179, GHSA-gm4x-83qc-5rx5, UBUNTU-CVE-2026-118179.