Description
Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Published: 2026-10-13
Score: 4.2 Medium
EPSS: n/a
KEV: No
Impact: Potential abuse of DNS resolution through a race condition in Firefox
Action: Immediate Patch
AI Analysis

Impact

Race condition found in the Networking: DNS component of Firefox and Thunderbird. The flaw arises from concurrent operations that can lead to unpredictable behavior in DNS resolution, possibly resulting in incorrect host-to-IP mapping. The CVSS score of 4.2 indicates moderate severity.

Affected Systems

Mozilla Firefox versions prior to 158 and Mozilla Thunderbird versions prior to 158 are affected. The vulnerability is present in all builds where the DNS component has not yet been updated to version 158.

Risk and Exploitability

The CVSS score of 4.2 indicates moderate severity. The EPSS score is not available and it is not listed in CISA's KEV catalog. Exploitation would require triggering the race condition by controlling DNS queries or internal state, but no public exploit evidence exists.

Generated by OpenCVE AI on October 13, 2026 at 20:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Mozilla Firefox to version 158 or later, which contains the DNS component patch.
  • Update Mozilla Thunderbird to version 158 or later, which contains the DNS component patch.
  • Temporarily configure the system to use a trusted, external DNS server to minimize the impact of the race condition until the patch can be applied.

Generated by OpenCVE AI on October 13, 2026 at 20:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158. Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
References

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158.
Title Race condition in the Networking: DNS component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T18:08:35.924Z

Reserved: 2026-10-13T00:49:13.115Z

Link: CVE-2026-109779

cve-icon Vulnrichment

Updated: 2026-10-13T14:53:44.460Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:28.817

Modified: 2026-10-13T19:18:42.413

Link: CVE-2026-109779

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T21:15:16Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')