vulnerability

MFSA2025-45 Thunderbird: Security Vulnerabilities fixed in Thunderbird 139 (CVE-2025-5270)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:C/I:N/A:N)

Published

May 27, 2025

Added

May 28, 2025

Modified

Apr 15, 2026

Description

In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139.

Solution

mozilla-thunderbird-upgrade-139_0

References

CVE-2025-5270
https://attackerkb.com/topics/CVE-2025-5270
CWE-319
EUVD-EUVD-2025-18106
http://www.mozilla.org/security/announce/2025/mfsa2025-45.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18106

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report