CVE-2026-75514
Received Received - Intake

Bypass of rDNS-based restrictions in BunkerWeb

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-75514
EUVD
EUVD-2026-63542

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bunkerity bunkerweb to 1.6.13 (exc)
bunkerweb bunkerweb to 1.6.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-350 The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75514 is a vulnerability in BunkerWeb versions before 1.6.13 where attackers can bypass reverse DNS-based security checks by spoofing PTR records. The blacklist, greylist, and antibot modules only check if a PTR record matches a trusted suffix but fail to verify if the domain resolves back to the client's IP address. This allows attackers to bypass security controls without owning the domain.

Detection Guidance

To detect this vulnerability, check if your BunkerWeb instance is running a version prior to 1.6.13. Use the command: bunkerweb --version. If the version is less than 1.6.13, the system is vulnerable. Additionally, review logs for suspicious bypass attempts where PTR records match trusted suffixes but fail FCrDNS validation.

Impact Analysis

Attackers could bypass rDNS-based blacklisting, greylisting, or antibot challenges by setting a PTR record matching a trusted suffix (e.g., '.googlebot.com'). This could allow unauthorized access, evasion of security controls, or automated attacks to go undetected.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements for data protection and security controls. Organizations using affected BunkerWeb versions may fail to meet standards like GDPR or HIPAA due to insufficient rDNS validation.

Mitigation Strategies

Upgrade BunkerWeb to version 1.6.13 or later immediately. This version includes FCrDNS validation for blacklist, greylist, and antibot modules. After upgrading, verify the fix by testing PTR record spoofing attempts to ensure they are properly blocked.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75514. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart