Loading story…
Two newly disclosed vulnerabilities affect DNS-related configuration handling in Froxlor and Pi-hole FTL, allowing authenticated low-privilege attackers to inject malicious content through unsanitized newline characters. In Froxlor before 2.3.5, the DomainZones.add API endpoint does not properly validate the content field for several DNS record types, enabling attackers with customer access and DNS enabled to insert additional lines and BIND directives such as $INCLUDE into zone files that are written during the DNS rebuild cron job. The flaw is tracked as CVE-2026-30932 and can lead to unauthorized manipulation of DNS zone configuration data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
A new CVE, CVE-2026-41230, was published for a Froxlor BIND zone file injection flaw in DomainZones::add() affecting versions prior to 2.3.6. The advisory says unsupported DNS record types can bypass validation and newline characters in record content can be used to inject arbitrary BIND directives; Froxlor 2.3.6 fixes the issue.
A new CVE, CVE-2026-35521, was published for Pi-hole FTL versions 6.0 through before 6.6, describing remote code execution via newline injection in the dhcp.hosts configuration parameter. The issue allows an authenticated attacker to inject arbitrary dnsmasq directives and was mapped to CWE-78 and CWE-93.
A new CVE, CVE-2026-35519, was published for Pi-hole FTL versions 6.0 through before 6.6, describing remote code execution via newline injection in the dns.hostRecord configuration parameter. The flaw allows an authenticated attacker to inject arbitrary dnsmasq directives and was mapped to CWE-78 and CWE-93.
Pi-hole FTL addressed the remote code execution issue caused by arbitrary dnsmasq directive injection through dns.upstreams by releasing version 6.6. The vulnerability was mapped to CWE-78 and CWE-93.
A CVE entry for Pi-hole FTL remote code execution via newline injection in the dns.upstreams configuration parameter was received by security-advisories@github.com. The flaw affects pihole-FTL versions 6.0 through before 6.6 and requires authenticated access.
A new vulnerability, CVE-2026-30932, was publicly disclosed for Froxlor, describing BIND zone file injection via unsanitized DNS record content in the DomainZones API. The issue was assigned CWE-74 and a high-severity CVSS v4.0 rating.
Froxlor patched a vulnerability in the DomainZones.add API endpoint that allowed newline injection into DNS record content and unauthorized manipulation of BIND zone files during DNS rebuilds. The flaw affects versions prior to 2.3.5.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Pi-hole disclosed two high-severity remote code execution vulnerabilities in its FTLDNS component, tracked as **CVE-2026-35518** and **CVE-2026-35520**, affecting `pihole-FTL` versions **6.0 through before 6.6**. The flaws let an authenticated attacker inject arbitrary `dnsmasq` configuration directives through newline characters in the `dns.cnameRecords` and `dhcp.leaseTime` configuration parameters, which can result in command execution on the underlying system. Both issues carry a **CVSS v3.1** score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, indicating low-complexity network exploitation with high impact to confidentiality, integrity, and availability once authenticated access is obtained. The vulnerabilities are mapped to **CWE-78** and **CWE-93**, and Pi-hole fixed both in **version 6.6**; one related advisory is published as **GHSA-28g5-gg88-wh5m**.
Jun 29, 2026
Microsoft has published a cluster of DNS-related security advisories covering **remote code execution, denial of service, cache poisoning, heap overflow, and access-control bypass** conditions across Windows DNS Server and third-party DNS components. The newly listed issues include `CVE-2026-33278` for possible arbitrary code execution during **DNSSEC** validation, `CVE-2026-42959` for crashes triggered by malicious DNSSEC content, `CVE-2026-42960` for possible cache poisoning through promiscuous authority-section records, and `CVE-2026-42944` for a heap overflow involving multiple `NSID`, `COOKIE`, and `PADDING` **EDNS** options. Additional advisories describe degradation-of-service conditions tied to long EDNS option lists (`CVE-2026-41292`), unbounded name compression (`CVE-2026-44390`), and a "packet of death" affecting **DNSCrypt** (`CVE-2026-32792`). The disclosures also reference flaws in widely used DNS software, including a **BIND 9** resolver unbounded resend loop (`CVE-2026-5950`), invalid handling of `CLASS != IN` (`CVE-2026-5946`), and a **CoreDNS** ACL bypass (`CVE-2026-26017`). Earlier Microsoft advisories for Windows DNS Server remote code execution, including `CVE-2021-33754` and `CVE-2021-33746`, show that DNS services remain a recurring high-impact target because they are network-exposed and central to enterprise operations. For defenders, the combined set of advisories highlights the need to prioritize patching DNS infrastructure, review exposure of DNSSEC, EDNS, and DNSCrypt features, and monitor for service instability or anomalous DNS responses that could indicate exploitation attempts.
Jun 29, 2026
NLnet Labs has addressed multiple vulnerabilities in the **Unbound** DNS resolver, including **`CVE-2026-33278`**, a high-severity flaw in the DNSSEC validator that can cause denial of service and potentially **remote code execution**. The bug affects Unbound versions **`1.19.1` through `1.25.0`** and stems from a deep-copy error that overwrites a destination pointer, later triggering a dangling-pointer dereference. The issue is tracked under **`CWE-416`** and **`CWE-672`** and carries high potential impact to confidentiality, integrity, and availability. Exploitation requires an attacker to control a malicious signed DNS zone and induce a vulnerable Unbound instance to query it while a **DS sub-query** is suspended because of **NSEC3 computational budget exhaustion**. Belgium's Centre for Cybersecurity warned that the Unbound vulnerabilities could enable denial-of-service and urged organizations to patch immediately. The vendor has fixed the issue in **Unbound `1.25.1`**, making upgrade a priority for operators using affected resolver versions.
Jun 29, 2026