crítica
CVE-2026-4700
firefox: thunderbird: Mitigation bypass in the Networking: HTTP component
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | firefox, thunderbird | 140.9.0-1.el8_10.alma.1 |
| alma 9 | firefox, firefox-x11, thunderbird | 140.9.0-1.el9_7.alma.1 |
| amazon linux 2 | thunderbird | 140.9.0-1.amzn2.0.2 |
| amazon linux 2023 | firefox, firefox-debuginfo, firefox-debugsource | 140.9.0-1.amzn2023.0.2 |
| chainguard | firefox, firefox-esr | 149.0-r0 y 1 más |
| debian 11 | firefox-esr, thunderbird | 140.9.0esr-1~deb11u1 y 1 más |
| debian 12 | firefox-esr, thunderbird | 140.9.0esr-1~deb12u1 y 1 más |
| debian 13 | firefox-esr, thunderbird | 140.9.0esr-1~deb13u1 y 1 más |
| debian 14 | firefox-esr, thunderbird | 140.9.0esr-1 y 1 más |
| echo | firefox-esr, thunderbird | 140.9.0esr-1~deb12u1 y 1 más |
| Oracle Linux 7 | firefox | 140.9.0-1.0.1.el7_9 |
| Oracle Linux 8 | firefox, thunderbird | 140.9.0-1.0.1.el8_10 |
Mostrar las 59 entradas de 32 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | firefox | 140.9.0-1.el8_10.alma.1 |
| alma 8 | thunderbird | 140.9.0-1.el8_10.alma.1 |
| alma 9 | firefox | 140.9.0-1.el9_7.alma.1 |
| alma 9 | firefox-x11 | 140.9.0-1.el9_7.alma.1 |
| alma 9 | thunderbird | 140.9.0-1.el9_7.alma.1 |
| amazon linux 2 | thunderbird | 140.9.0-1.amzn2.0.2 |
| amazon linux 2023 | firefox | 140.9.0-1.amzn2023.0.2 |
| amazon linux 2023 | firefox-debuginfo | 140.9.0-1.amzn2023.0.2 |
| amazon linux 2023 | firefox-debugsource | 140.9.0-1.amzn2023.0.2 |
| chainguard | firefox | 149.0-r0 |
| chainguard | firefox-esr | 140.9.0-r0 |
| debian 11 | firefox-esr | 140.9.0esr-1~deb11u1 |
| debian 11 | thunderbird | 1:140.9.0esr-1~deb11u1 |
| debian 12 | firefox-esr | 140.9.0esr-1~deb12u1 |
| debian 12 | thunderbird | 1:140.9.0esr-1~deb12u1 |
| debian 13 | firefox-esr | 140.9.0esr-1~deb13u1 |
| debian 13 | thunderbird | 1:140.9.0esr-1~deb13u1 |
| debian 14 | firefox-esr | 140.9.0esr-1 |
| debian 14 | thunderbird | 1:140.9.0esr-1 |
| echo | firefox-esr | 140.9.0esr-1~deb12u1 |
| echo | thunderbird | 1:140.9.0esr-1~deb12u1 |
| Oracle Linux 7 | firefox | 140.9.0-1.0.1.el7_9 |
| Oracle Linux 8 | firefox | 140.9.0-1.0.1.el8_10 |
| Oracle Linux 8 | thunderbird | 140.9.0-1.0.1.el8_10 |
| Oracle Linux 9 | firefox | 140.9.0-1.0.1.el9_7 |
| Oracle Linux 9 | firefox-x11 | 140.9.0-1.0.1.el9_7 |
| Oracle Linux 9 | thunderbird | 140.9.0-1.0.1.el9_7 |
| rapidfort alpine 3.20 | thunderbird | 144.0-r0 |
| rapidfort alpine 3.21 | thunderbird | 144.0-r0 |
| rapidfort alpine 3.22 | thunderbird | 144.0-r0 |
| rapidfort alpine 3.23 | thunderbird | 144.0-r0 |
| rapidfort amazon linux 2023 | firefox | 140.9.0-1.amzn2023.0.2 |
| rapidfort debian 12 | firefox-esr | 0:140.9.0esr-1, 0:140.9.0esr-1~deb11u1, 0:140.9.0esr-1~deb12u1, 0:140.9.0esr-1~deb13u1 |
| rapidfort debian 12 | thunderbird | 0:140.9.0esr-1~deb11u1, 0:140.9.0esr-1~deb12u1, 0:140.9.0esr-1~deb13u1, 1:140.9.0esr-1 |
| rapidfort debian 13 | firefox-esr | 0:140.9.0esr-1, 0:140.9.0esr-1~deb11u1, 0:140.9.0esr-1~deb12u1, 0:140.9.0esr-1~deb13u1 |
| rapidfort debian 13 | thunderbird | 0:140.9.0esr-1~deb11u1, 0:140.9.0esr-1~deb12u1, 0:140.9.0esr-1~deb13u1, 1:140.9.0esr-1 |
| rapidfort fedora 43 | firefox | 149.0.2-1.fc43 |
| rapidfort fedora 43 | firefox-langpacks | 149.0.2-1.fc43 |
| rapidfort fedora 43 | thunderbird | 145.0-1.fc43 |
| rapidfort fedora 43 | thunderbird-librnp-rnp | 145.0-1.fc43 |
| rapidfort Oracle Linux 10 | firefox | 0:140.9.0-1.0.1.el10_1 |
| rapidfort Oracle Linux 10 | thunderbird | 0:140.9.0-1.0.1.el10_1 |
| rapidfort Oracle Linux 9 | firefox | 0:140.9.0-1.0.1.el9_7 |
| rapidfort Oracle Linux 9 | firefox-x11 | 0:140.9.0-1.0.1.el9_7 |
| rapidfort Oracle Linux 9 | thunderbird | 0:140.9.0-1.0.1.el9_7 |
| rapidfort ubuntu 20.04 | thunderbird | sin corrección indicada |
| rapidfort ubuntu 22.04 | thunderbird | sin corrección indicada |
| rapidfort ubuntu 24.04 | thunderbird | sin corrección indicada |
| Red Hat | firefox | sin corrección indicada |
| Red Hat | thunderbird | sin corrección indicada |
| rocky 10 | firefox | 140.9.0-1.el10_1 |
| rocky 10 | thunderbird | 140.9.0-1.el10_1 |
| rocky 8 | firefox | 140.9.0-1.el8_10 |
| rocky 8 | thunderbird | 140.9.0-1.el8_10 |
| rocky 9 | firefox | 140.9.0-1.el9_7 |
| rocky 9 | firefox-x11 | 140.9.0-1.el9_7 |
| rocky 9 | thunderbird | 140.9.0-1.el9_7 |
| ubuntu 22.04 | thunderbird | sin corrección indicada |
| wolfi | firefox | 149.0-r0 |
Referencias
- https://access.redhat.com/errata/RHSA-2026:5930
- https://access.redhat.com/errata/RHSA-2026:5931
- https://access.redhat.com/errata/RHSA-2026:5932
- https://access.redhat.com/errata/RHSA-2026:6188
- https://access.redhat.com/errata/RHSA-2026:6342
- https://access.redhat.com/errata/RHSA-2026:6917
- https://access.redhat.com/errata/RHSA-2026:7837
- https://access.redhat.com/errata/RHSA-2026:7838
Las 161 referencias
- https://access.redhat.com/errata/RHSA-2026:7839
- https://access.redhat.com/errata/RHSA-2026:7840
- https://access.redhat.com/errata/RHSA-2026:7841
- https://access.redhat.com/errata/RHSA-2026:7842
- https://access.redhat.com/errata/RHSA-2026:7843
- https://access.redhat.com/errata/RHSA-2026:7845
- https://access.redhat.com/errata/RHSA-2026:7858
- https://access.redhat.com/errata/RHSA-2026:8284
- https://access.redhat.com/errata/RHSA-2026:8285
- https://access.redhat.com/errata/RHSA-2026:8286
- https://access.redhat.com/errata/RHSA-2026:8287
- https://access.redhat.com/errata/RHSA-2026:8288
- https://access.redhat.com/errata/RHSA-2026:8289
- https://access.redhat.com/errata/RHSA-2026:8290
- https://access.redhat.com/errata/RHSA-2026:8315
- https://access.redhat.com/errata/RHSA-2026:8427
- https://access.redhat.com/errata/RHSA-2026:8850
- https://access.redhat.com/security/cve/CVE-2026-4700
- https://bugzilla.mozilla.org/show_bug.cgi?id=2003766
- https://bugzilla.redhat.com/2450710
- https://bugzilla.redhat.com/2450711
- https://bugzilla.redhat.com/2450712
- https://bugzilla.redhat.com/2450713
- https://bugzilla.redhat.com/2450714
- https://bugzilla.redhat.com/2450715
- https://bugzilla.redhat.com/2450718
- https://bugzilla.redhat.com/2450719
- https://bugzilla.redhat.com/2450720
- https://bugzilla.redhat.com/2450721
- https://bugzilla.redhat.com/2450722
- https://bugzilla.redhat.com/2450723
- https://bugzilla.redhat.com/2450724
- https://bugzilla.redhat.com/2450725
- https://bugzilla.redhat.com/2450726
- https://bugzilla.redhat.com/2450727
- https://bugzilla.redhat.com/2450728
- https://bugzilla.redhat.com/2450729
- https://bugzilla.redhat.com/2450730
- https://bugzilla.redhat.com/2450732
- https://bugzilla.redhat.com/2450733
- https://bugzilla.redhat.com/2450734
- https://bugzilla.redhat.com/2450735
- https://bugzilla.redhat.com/2450738
- https://bugzilla.redhat.com/2450739
- https://bugzilla.redhat.com/2450740
- https://bugzilla.redhat.com/2450741
- https://bugzilla.redhat.com/2450742
- https://bugzilla.redhat.com/2450744
- https://bugzilla.redhat.com/2450746
- https://bugzilla.redhat.com/2450747
- https://bugzilla.redhat.com/2450748
- https://bugzilla.redhat.com/2450751
- https://bugzilla.redhat.com/2450752
- https://bugzilla.redhat.com/2450755
- https://bugzilla.redhat.com/2450756
- https://bugzilla.redhat.com/2450757
- https://bugzilla.redhat.com/2451001
- https://bugzilla.redhat.com/2451006
- https://bugzilla.redhat.com/show_bug.cgi?id=2450710
- https://bugzilla.redhat.com/show_bug.cgi?id=2450711
- https://bugzilla.redhat.com/show_bug.cgi?id=2450712
- https://bugzilla.redhat.com/show_bug.cgi?id=2450713
- https://bugzilla.redhat.com/show_bug.cgi?id=2450714
- https://bugzilla.redhat.com/show_bug.cgi?id=2450715
- https://bugzilla.redhat.com/show_bug.cgi?id=2450718
- https://bugzilla.redhat.com/show_bug.cgi?id=2450719
- https://bugzilla.redhat.com/show_bug.cgi?id=2450720
- https://bugzilla.redhat.com/show_bug.cgi?id=2450721
- https://bugzilla.redhat.com/show_bug.cgi?id=2450722
- https://bugzilla.redhat.com/show_bug.cgi?id=2450723
- https://bugzilla.redhat.com/show_bug.cgi?id=2450724
- https://bugzilla.redhat.com/show_bug.cgi?id=2450725
- https://bugzilla.redhat.com/show_bug.cgi?id=2450726
- https://bugzilla.redhat.com/show_bug.cgi?id=2450727
- https://bugzilla.redhat.com/show_bug.cgi?id=2450728
- https://bugzilla.redhat.com/show_bug.cgi?id=2450729
- https://bugzilla.redhat.com/show_bug.cgi?id=2450730
- https://bugzilla.redhat.com/show_bug.cgi?id=2450732
- https://bugzilla.redhat.com/show_bug.cgi?id=2450733
- https://bugzilla.redhat.com/show_bug.cgi?id=2450734
- https://bugzilla.redhat.com/show_bug.cgi?id=2450735
- https://bugzilla.redhat.com/show_bug.cgi?id=2450738
- https://bugzilla.redhat.com/show_bug.cgi?id=2450739
- https://bugzilla.redhat.com/show_bug.cgi?id=2450740
- https://bugzilla.redhat.com/show_bug.cgi?id=2450741
- https://bugzilla.redhat.com/show_bug.cgi?id=2450742
- https://bugzilla.redhat.com/show_bug.cgi?id=2450744
- https://bugzilla.redhat.com/show_bug.cgi?id=2450746
- https://bugzilla.redhat.com/show_bug.cgi?id=2450747
- https://bugzilla.redhat.com/show_bug.cgi?id=2450748
- https://bugzilla.redhat.com/show_bug.cgi?id=2450751
- https://bugzilla.redhat.com/show_bug.cgi?id=2450752
- https://bugzilla.redhat.com/show_bug.cgi?id=2450755
- https://bugzilla.redhat.com/show_bug.cgi?id=2450756
- https://bugzilla.redhat.com/show_bug.cgi?id=2450757
- https://bugzilla.redhat.com/show_bug.cgi?id=2451001
- https://bugzilla.redhat.com/show_bug.cgi?id=2451006
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3889
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4371
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4684
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4685
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4686
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4687
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4688
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4689
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4690
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4691
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4692
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4693
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4694
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4695
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4696
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4697
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4698
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4699
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4700
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4701
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4702
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4704
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4705
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4706
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4707
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4708
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4709
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4710
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4711
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4712
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4713
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4714
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4715
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4716
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4717
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4718
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4719
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4720
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4721
- https://errata.almalinux.org/9/ALSA-2026-6188.html
- https://errata.rockylinux.org/RLSA-2026:6188
- https://linux.oracle.com/cve/CVE-2026-4700.html
- https://linux.oracle.com/errata/ELSA-2026-8427.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-4700
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4700.json
- https://www.cve.org/CVERecord?id=CVE-2026-4700
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-20/#CVE-2026-4700
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-22/#CVE-2026-4700
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-24/#CVE-2026-4700
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-22/
- https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2026-4700
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
- https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2026-4700