CVE-2025-8036: DNS rebinding circumvents CORS
Firefox cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding.
Other sources
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 141 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 140.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-8036?
CVE-2025-8036 has a moderate severity level due to its potential to circumvent CORS protections.
How do I fix CVE-2025-8036?
To fix CVE-2025-8036, users should update Firefox to version 141 or newer, or Firefox ESR to version 140.1 or newer.
What does CVE-2025-8036 affect?
CVE-2025-8036 affects Mozilla Firefox versions up to 141 and Firefox ESR versions up to 140.1.
What kind of attack does CVE-2025-8036 enable?
CVE-2025-8036 enables DNS rebinding attacks that can bypass CORS by allowing cached preflight responses across IP address changes.
Is CVE-2025-8036 a remote code execution vulnerability?
No, CVE-2025-8036 is not a remote code execution vulnerability, but it can lead to security breaches through improper handling of CORS.