CVE-2026-84642: Allowed UNC hostnames for attachments interpreted as a regular expression
The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 155 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.2 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 155 - Configuration
Update the value of the advanced config setting mail.allowed_attachment_hostnames to be regex-safe by escaping any regex metacharacters, preventing unintended hostnames from matching attachment-serving rules.
Thunderbird mail.allowed_attachment_hostnames = Use hostname patterns escaped for regular expressions (ensure regex metacharacters are escaped so only intended hostnames match).
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-84639
- CVE-2026-84640
- CVE-2026-84641
- CVE-2026-84642
- CVE-2026-84118
- CVE-2026-84119
- CVE-2026-84120
- CVE-2026-84121
- CVE-2026-84122
- CVE-2026-84123
- CVE-2026-84124
- CVE-2026-84125
- CVE-2026-84126
- CVE-2026-84128
- CVE-2026-84129
- CVE-2026-84130
- CVE-2026-84131
- CVE-2026-84132
- CVE-2026-84133
- CVE-2026-84134
- CVE-2026-84136
- CVE-2026-84137
- CVE-2026-84138
- CVE-2026-84139
- CVE-2026-84140
- CVE-2026-84141
- CVE-2026-84142
- CVE-2026-84143
- CVE-2026-84144
- CVE-2026-84145
- CVE-2026-84637
- CVE-2026-75874
- CVE-2026-74952
Frequently Asked Questions
Who is exposed to this issue?
Users of Thunderbird configurations that use the mail.allowed_attachment_hostnames advanced setting may be exposed. The issue applies when configured hostname values can be interpreted as regular-expression patterns that also match unintended UNC hosts.
What is required for exploitation?
An attacker would need to use an unintended hostname that matches the regular expression derived from an allowed hostname entry and cause remote attachments to be served from that host. The provided information does not establish that default Thunderbird configurations are affected.
How can administrators mitigate the issue before updating?
Review mail.allowed_attachment_hostnames entries for hostname characters that have special meaning in regular expressions, since those values were not escaped. Updating to Thunderbird 155 applies the stated fix.