CVE-2026-41234
Newline Injection in Froxlor DNS TXT Records
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| froxlor | froxlor | to 2.3.7 (exc) |
| froxlor | froxlor | to 2.3.6 (exc) |
| froxlor | froxlor | to 2.3.5 (exc) |
| froxlor | froxlor | to 2.3.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41234 is a vulnerability in Froxlor server administration software versions 2.3.6 and earlier. It occurs because the DomainZones.add API endpoint does not properly sanitize newline characters in TXT DNS record content.
An authenticated user with DNS editing privileges can inject newline characters into TXT record values. This breaks out of the intended record line in the generated BIND zone file, allowing the attacker to insert arbitrary BIND directives such as $INCLUDE or $GENERATE, as well as malicious DNS records like A, MX, or CNAME entries.
This vulnerability is a partial regression of a previous issue (CVE-2026-30932) that was fixed for other DNS record types but missed TXT records. The root cause is insufficient sanitization in the TXT record handling function, which only manages quote characters but does not remove newlines or other BIND metacharacters.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to several serious impacts:
- Information disclosure by including arbitrary files on the server via the $INCLUDE directive.
- DNS service disruption caused by malformed zone files that prevent BIND from loading zones correctly.
- Manipulation of DNS zone data by injecting arbitrary DNS records, which can facilitate subdomain takeover or email interception.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying whether your Froxlor installation is running a vulnerable version (2.3.6 or earlier) and checking for suspicious TXT DNS records containing newline characters or unexpected BIND directives such as $INCLUDE or $GENERATE in the zone files.
You can inspect the BIND zone files generated by Froxlor for injected directives or malformed TXT records. For example, use commands like:
- grep -P '\n' /path/to/bind/zones/*.zone
- grep -E '\$INCLUDE|\$GENERATE' /path/to/bind/zones/*.zone
Additionally, reviewing DNS TXT records via DNS query tools to detect unexpected multiline TXT records or unusual entries can help. For example:
- dig TXT yourdomain.com
- host -t TXT yourdomain.com
Monitoring API usage logs for unusual or unauthorized DNS TXT record modifications by authenticated users with DNS editing privileges can also help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Froxlor to version 2.3.7 or later, which contains the updated patch that properly sanitizes newline characters and BIND metacharacters in TXT record content.
If upgrading immediately is not possible, restrict DNS editing privileges to trusted users only and monitor DNS record changes closely.
Implement additional validation or filtering on the DomainZones.add API endpoint to strip or reject TXT record content containing newline characters or BIND directives.
Review and clean existing BIND zone files to remove any injected directives or malformed records that may have been introduced.
Finally, consider temporarily disabling the DNS rebuild cron job until the patch is applied to prevent writing malicious zone files to disk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated users with DNS editing privileges to inject arbitrary BIND directives and DNS records into zone files, potentially leading to information disclosure, DNS service disruption, and manipulation of DNS data.
Such impacts on confidentiality and integrity could affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.
However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.