CVE-2026-75514

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75514", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-17T20:49:21.599Z", "datePublished": "2026-08-20T18:31:51.527Z", "dateUpdated": "2026-08-20T19:00:33.894Z"}, "containers": {"cna": {"title": "BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot", "problemTypes": [{"descriptions": [{"cweId": "CWE-350", "lang": "en", "description": "CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm"}, {"name": "https://github.com/bunkerity/bunkerweb/pull/3710", "tags": ["x_refsource_MISC"], "url": "https://github.com/bunkerity/bunkerweb/pull/3710"}, {"name": "https://github.com/bunkerity/bunkerweb/commit/1a97e5b3f977130a1b84507a9e1f703c8eec12eb", "tags": ["x_refsource_MISC"], "url": "https://github.com/bunkerity/bunkerweb/commit/1a97e5b3f977130a1b84507a9e1f703c8eec12eb"}, {"name": "https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.13"}], "affected": [{"vendor": "bunkerity", "product": "bunkerweb", "versions": [{"version": "< 1.6.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:31:51.527Z"}, "descriptions": [{"lang": "en", "value": "BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13."}], "source": {"advisory": "GHSA-q54j-5484-pvjm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T18:58:07.780705Z", "id": "CVE-2026-75514", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:00:33.894Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-75514", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T18:58:07.780705Z"}}}], "references": [{"url": "https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T18:59:19.086Z"}}], "cna": {"title": "BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot", "source": {"advisory": "GHSA-q54j-5484-pvjm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "bunkerity", "product": "bunkerweb", "versions": [{"status": "affected", "version": "< 1.6.13"}]}], "references": [{"url": "https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm", "name": "https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bunkerity/bunkerweb/pull/3710", "name": "https://github.com/bunkerity/bunkerweb/pull/3710", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/bunkerity/bunkerweb/commit/1a97e5b3f977130a1b84507a9e1f703c8eec12eb", "name": "https://github.com/bunkerity/bunkerweb/commit/1a97e5b3f977130a1b84507a9e1f703c8eec12eb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.13", "name": "https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.13", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-350", "description": "CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:31:51.527Z"}}}, "cveMetadata": {"cveId": "CVE-2026-75514", "state": "PUBLISHED", "dateUpdated": "2026-08-20T19:00:33.894Z", "dateReserved": "2026-08-17T20:49:21.599Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T18:31:51.527Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bunkerweb", "vendor": "bunkerity", "versions": [{"status": "affected", "version": "< 1.6.13"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13."}, {"lang": "es", "value": "BunkerWeb es un cortafuegos de aplicaciones web de c\u00f3digo abierto y de pr\u00f3xima generaci\u00f3n. Antes de la 1.6.13, los m\u00f3dulos de lista negra, lista gris y antibot en src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua y src/common/core/antibot/antibot.lua conf\u00edan en las coincidencias de sufijo PTR en IGNORE_RDNS, GREYLIST_RDNS y ANTIBOT_IGNORE_RDNS sin usar get_ips para confirmar que el nombre de host se resuelve en la direcci\u00f3n del cliente. Un atacante remoto no autenticado que controla un registro PTR puede suplantar un sufijo de confianza para eludir la inclusi\u00f3n en listas negras basada en rDNS, obtener tratamiento de lista gris o saltarse un desaf\u00edo antibot. Este problema se ha solucionado en la versi\u00f3n 1.6.13."}], "id": "CVE-2026-75514", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75514", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T18:58:07.780705Z", "version": "2.0.3"}}]}, "published": "2026-08-20T19:17:03.637", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/bunkerity/bunkerweb/commit/1a97e5b3f977130a1b84507a9e1f703c8eec12eb"}, {"source": "security-advisories@github.com", "url": "https://github.com/bunkerity/bunkerweb/pull/3710"}, {"source": "security-advisories@github.com", "url": "https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.13"}, {"source": "security-advisories@github.com", "url": "https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-350"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.13)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "bunkerweb", "source": "cna", "vendor": "bunkerity"}, "product": "bunker_web", "vendor": "bunkerity"}], "created": "2026-08-21T01:45:08.037969+00:00", "updated": "2026-08-21T13:00:52.204030+00:00", "vendors": ["bunkerity", "bunkerity$PRODUCT$bunker_web"]}