medium5.3
CVE-2025-26695
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested emai…
Impact
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Thunderbird | before 128.8.0 from 129.0 before 136.0 |