CVE-2026-41237
Froxlor DNS Record Validation Bypass Vulnerabilities
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| froxlor | froxlor | to 2.3.7 (exc) |
| froxlor | froxlor | From 2.3.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41237 is an incomplete fix for a previous vulnerability in the Froxlor server management panel that affects DNS record validation.
The vulnerability arises because the LOC record regex uses \s+ which matches newlines, allowing embedded newlines to pass validation and produce multiple lines in zone files.
Additionally, TLSA records with matchingType=0 have no upper bound on hex data length, enabling arbitrarily large payloads.
All validators return raw input without escaping zone-file special characters, leaving the system vulnerable to injection attacks.
An authenticated Froxlor user with DNS management permissions can exploit these issues to inject arbitrary records into bind9 zone files.
How can this vulnerability impact me? :
Exploitation of this vulnerability can allow attackers to inject malicious DNS records into zone files.
- Domain hijacking by redirecting DNS queries to attacker-controlled servers.
- Phishing attacks facilitated by malicious DNS entries.
- DNS amplification attacks using unbounded TLSA payloads.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves improper validation of DNS record inputs in Froxlor versions 2.3.6 and earlier, specifically for LOC, RP, SSHFP, and TLSA record types. Detection involves checking if your Froxlor installation is running a vulnerable version and inspecting DNS zone files for suspicious or malformed records that may contain embedded newlines or unusually large TLSA payloads.
You can detect the vulnerability by verifying the Froxlor version and examining DNS zone files for anomalies such as embedded newlines in LOC records or excessively long TLSA matchingType=0 data.
- Check Froxlor version: `froxlord --version` or check the installed package version.
- Search DNS zone files for LOC records containing newlines: `grep -P 'LOC.*\n' /path/to/zonefiles/*`
- Check TLSA records with matchingType=0 for unusually long hex data: `grep -P 'TLSA.*matchingType=0' /path/to/zonefiles/* | awk '{ if (length($NF) > expected_length) print $0 }'` (replace expected_length with a reasonable upper bound)
- Review Froxlor DNS management logs for unauthorized or suspicious record injections.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Froxlor to version 2.3.7 or later, which contains patches addressing the incomplete fix for this vulnerability.
The patch includes replacing the LOC record regex to exclude newlines, adding maximum length checks for TLSA matchingType=0 data, and properly escaping or rejecting newlines in all DNS record content before writing to zone files.
Additionally, review and restrict DNS management permissions to trusted authenticated users only, and monitor DNS zone files for suspicious entries.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Froxlor allows authenticated users with DNS management permissions to inject arbitrary DNS records into zone files, potentially enabling domain hijacking, phishing attacks, or DNS amplification. Such security weaknesses can lead to unauthorized data exposure or manipulation, which may impact compliance with standards like GDPR or HIPAA that require protection of data integrity and confidentiality.
Specifically, the injection of malicious DNS records could facilitate phishing or other attacks that compromise user data or system integrity, thereby violating regulatory requirements for data protection and security controls.
However, the provided information does not explicitly discuss compliance with any specific standards or regulations.