CVE-2026-84642

Thunderbird (Mozilla) contained a vulnerability in the mail.allowed_attachment_hostnames advanced configuration setting, where values were used in a regular expression without escaping . For certain valid hostnames, this could allow unintended hostnames to also match and serve remote attachments ...