Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.