CVE-2026-100795: Firefox and Thunderbird DOS Vulnerability

CVE-2026-100795 Overview

CVE-2026-100795 is a denial-of-service vulnerability in the Networking component of Mozilla Firefox and Thunderbird. The flaw stems from improper resource control [CWE-770] and can be triggered remotely when a user interacts with attacker-controlled content. Mozilla fixed the issue in Firefox 157 and Thunderbird 157.

Successful exploitation exhausts networking resources and causes the affected application to become unresponsive. The vulnerability requires user interaction but does not require authentication or elevated privileges.

Critical Impact
Remote attackers can force Firefox or Thunderbird into a denial-of-service state through network-borne content, disrupting browsing and mail workflows.

Affected Products

Mozilla Firefox versions prior to 157
Mozilla Thunderbird versions prior to 157
Systems relying on the affected Mozilla Networking component

Discovery Timeline

2026-09-29 - CVE CVE-2026-100795 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100795

Vulnerability Analysis

The vulnerability resides in the Networking component shared by Firefox and Thunderbird. It is classified as Allocation of Resources Without Limits or Throttling [CWE-770]. When the client processes crafted network responses or traffic patterns, the component fails to enforce upper bounds on resource consumption. The resulting exhaustion halts responsiveness of the parent process and dependent tabs or mail folders.

Mozilla addressed the defect in Firefox 157 and Thunderbird 157. Details are tracked in Mozilla Bug Report #2048871 and documented in Mozilla Security Advisory MFSA-2026-97 and Mozilla Security Advisory MFSA-2026-101.

Root Cause

The root cause is missing throttling or quota enforcement inside the Networking stack. Requests or responses that should be bounded consume memory, sockets, or CPU cycles without limit. Under sustained input the browser or mail client cannot service legitimate operations.

Attack Vector

Exploitation occurs over the network and requires user interaction, such as visiting a malicious page or rendering an email that triggers network activity. No credentials are required. The impact is limited to availability; confidentiality and integrity are not affected.

No public proof-of-concept or exploitation code has been published. Technical mechanics are described in prose only; refer to the Mozilla advisories linked above for authoritative details.

Detection Methods for CVE-2026-100795

Indicators of Compromise

Repeated Firefox or Thunderbird process hangs or crashes correlated with browsing or mail retrieval activity.
Sudden spikes in memory, handle, or socket usage by firefox.exe, firefox, or thunderbird processes.
Client connections to a single remote endpoint that generate abnormally large volumes of small or malformed network responses.

Detection Strategies

Inventory installed Mozilla builds and flag hosts running Firefox or Thunderbird earlier than version 157.
Correlate application crash telemetry with recently visited URLs or IMAP/POP/SMTP endpoints to identify triggering sources.
Alert on outbound sessions where Mozilla clients receive sustained response streams from untrusted origins.

Monitoring Recommendations

Track process resource metrics for Firefox and Thunderbird and raise alerts on abrupt memory or socket growth.
Ingest browser and endpoint telemetry into a centralized data lake to correlate DoS symptoms with network activity.
Monitor Mozilla security advisory feeds so that new Networking component fixes are reviewed and deployed promptly.

How to Mitigate CVE-2026-100795

Immediate Actions Required

Upgrade Firefox to version 157 or later on all managed endpoints.
Upgrade Thunderbird to version 157 or later, including ESR channels once fixed builds are available.
Restart affected applications after patching to ensure the vulnerable Networking component is unloaded.

Patch Information

Mozilla shipped fixes in Firefox 157 and Thunderbird 157. Refer to Mozilla Security Advisory MFSA-2026-97 and Mozilla Security Advisory MFSA-2026-101 for the authoritative fix mapping. Enterprise administrators should validate that automatic update channels have delivered the patched builds.

Workarounds

Restrict browsing to trusted sites until patching is complete, using web filtering or proxy allowlists.
Configure Thunderbird to fetch mail only from trusted servers and disable remote content in messages.
Enforce process resource limits on managed workstations to reduce the blast radius of a resource-exhaustion event.

bash

# Verify installed Firefox and Thunderbird versions on Linux endpoints
firefox --version
thunderbird --version

# Windows: query installed versions via registry
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Thunderbird" /v CurrentVersion