PoC Archive PoC Archive

tag

Dns

  • CVE-2026-27831 binary MEDIUM

    rldns 1.3 Heap-Based Out-of-Bounds Read Remote DoS (CVE-2026-27831)

    rldns is an open-source DNS server for Linux, FreeBSD, and NetBSD. Version 1.3 contains a heap-based out-of-bounds read that can be triggered remotely by sending a specially crafted, malformed DNS-like UDP packet, causing the server process to crash and…

    Patched 2026-07-05
  • CVE-2026-32945 network MEDIUM

    PJSIP DNS Compression Pointer Heap Out-of-Bounds Read (CVE-2026-32945)

    getnamelen() and getname() in pjproject's pjlib-util/src/pjlib-util/dns.c read a 2-byte DNS message-compression pointer via pjmemcpy(&offset, p, 2) without verifying that both bytes fall within the received packet buffer. If the compression-pointer marker…

    Patched 2026-07-05
  • CVE-2026-5172 network INFO

    dnsmasq extract_addresses() RDLEN/RDATA Buffer Overflow — CVE-2026-5172

    The PoC targets extractaddresses() in dnsmasq, which parses resource records (RRs) returned by an upstream DNS server. The function is reported to trust the RR's declared RDLENGTH field without properly validating it against the actual RDATA bytes present in…

    Patched 2026-07-05
  • CVE-2026-4893 network MEDIUM

    dnsmasq EDNS Client Subnet (ECS) Response Validation Bypass (CVE-2026-4893)

    This PoC demonstrates that dnsmasq, when configured with EDNS Client Subnet (ECS, RFC 7871) via add-subnet, will accept an upstream DNS response carrying an ECS option whose subnet does not match the subnet dnsmasq originally sent in the query. The included…

    Patched 2026-07-05
  • None assigned as of 2026-07-03 network HIGH

    c-ares TCP ares_getaddrinfo() Use-After-Free Code Execution

    c-ares's aresgetaddrinfo() path over DNS-over-TCP with EDNS enabled contains a use-after-free reachable when a malicious or compromised DNS server sends two responses for the same query ID in a single TCP read — the first a FORMERR without OPT data…

    Unverified 2026-07-03