CVE-2020-26961

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Dec 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-269626.1Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have be CVE-2020-269634.3Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limit CVE-2020-269646.8If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could CVE-2020-269656.5Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed CVE-2020-269666.5Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting CVE-2020-269676.5When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with eleme CVE-2020-269688.8Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corr CVE-2020-269698.8Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume CVE-2020-26974.9Vulnerability in the Oracle Hospitality Suites Management component of Oracle Food and Beverage Applications. Supported versions that are af CVE-2020-269708.8When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one b CVE-2020-269718.8Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnera CVE-2020-269729.8The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting t