tag
Dns
rldns 1.3 Heap-Based Out-of-Bounds Read Remote DoS (CVE-2026-27831)
rldns is an open-source DNS server for Linux, FreeBSD, and NetBSD. Version 1.3 contains a heap-based out-of-bounds read that can be triggered remotely by sending a specially crafted, malformed DNS-like UDP packet, causing the server process to crash and…
PJSIP DNS Compression Pointer Heap Out-of-Bounds Read (CVE-2026-32945)
getnamelen() and getname() in pjproject's pjlib-util/src/pjlib-util/dns.c read a 2-byte DNS message-compression pointer via pjmemcpy(&offset, p, 2) without verifying that both bytes fall within the received packet buffer. If the compression-pointer marker…
dnsmasq extract_addresses() RDLEN/RDATA Buffer Overflow — CVE-2026-5172
The PoC targets extractaddresses() in dnsmasq, which parses resource records (RRs) returned by an upstream DNS server. The function is reported to trust the RR's declared RDLENGTH field without properly validating it against the actual RDATA bytes present in…
dnsmasq EDNS Client Subnet (ECS) Response Validation Bypass (CVE-2026-4893)
This PoC demonstrates that dnsmasq, when configured with EDNS Client Subnet (ECS, RFC 7871) via add-subnet, will accept an upstream DNS response carrying an ECS option whose subnet does not match the subnet dnsmasq originally sent in the query. The included…
c-ares TCP ares_getaddrinfo() Use-After-Free Code Execution
c-ares's aresgetaddrinfo() path over DNS-over-TCP with EDNS enabled contains a use-after-free reachable when a malicious or compromised DNS server sends two responses for the same query ID in a single TCP read — the first a FORMERR without OPT data…