Loading story…
Pi-hole disclosed two high-severity remote code execution vulnerabilities in its FTLDNS component, tracked as CVE-2026-35518 and CVE-2026-35520, affecting pihole-FTL versions 6.0 through before 6.6. The flaws let an authenticated attacker inject arbitrary dnsmasq configuration directives through newline characters in the dns.cnameRecords and dhcp.leaseTime configuration parameters, which can result in command execution on the underlying system.
Both issues carry a CVSS v3.1 score vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low-complexity network exploitation with high impact to confidentiality, integrity, and availability once authenticated access is obtained. The vulnerabilities are mapped to CWE-78 and CWE-93, and Pi-hole fixed both in version 6.6; one related advisory is published as GHSA-28g5-gg88-wh5m.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Two CVE records were published for the Pi-hole FTL vulnerabilities, documenting the FTLDNS newline-injection RCE issues and linking them to GitHub security advisories. Both entries assigned high-severity CVSS 3.1 scores and mapped the flaws to CWE-78 and CWE-93.
Pi-hole addressed two authenticated remote code execution vulnerabilities in FTLDNS affecting versions 6.0 through before 6.6. The flaws involved improper handling of the dhcp.leaseTime and dns.cnameRecords configuration parameters, allowing newline injection of arbitrary dnsmasq directives and potential command execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly disclosed vulnerabilities affect DNS-related configuration handling in **Froxlor** and **Pi-hole FTL**, allowing authenticated low-privilege attackers to inject malicious content through unsanitized newline characters. In **Froxlor** before `2.3.5`, the `DomainZones.add` API endpoint does not properly validate the `content` field for several DNS record types, enabling attackers with customer access and DNS enabled to insert additional lines and BIND directives such as `$INCLUDE` into zone files that are written during the DNS rebuild cron job. The flaw is tracked as `CVE-2026-30932` and can lead to unauthorized manipulation of DNS zone configuration data.
Jun 29, 2026
CERT/CC and the dnsmasq maintainer disclosed six vulnerabilities in **dnsmasq** that affect most supported, non-legacy versions and can lead to DNS cache poisoning, denial of service, information disclosure, security-control bypass, heap manipulation, and local privilege escalation. The issues are tracked as `CVE-2026-2291`, `CVE-2026-4890`, `CVE-2026-4891`, `CVE-2026-4892`, `CVE-2026-4893`, and `CVE-2026-5172`, and stem from flaws in memory safety, input validation, DNSSEC handling, DHCPv6, and DNS parsing. Several attack paths are remote via crafted DNS packets or malformed DNS responses, while `CVE-2026-4892` is a heap-based out-of-bounds write in DHCPv6 that can let a local attacker execute arbitrary code as root with a crafted packet. Maintainer Simon Kelley released **dnsmasq `2.92rel2`** with backported fixes for the stable branch and indicated the fixes are incorporated into **version `2.93`**, which CERT/CC lists as fixed. Vendor remediation followed quickly, including a Debian security update (`DSA 6264-1`), and additional vendors were expected to publish patched packages. The disclosure drew attention because dnsmasq is widely deployed in routers, Linux systems, and embedded environments, making prompt patching important wherever the service is exposed to untrusted DNS or local network traffic.
Jul 20, 2026
A heap buffer overflow in **Dnsmasq** tracked as `CVE-2026-2291` can be triggered when the resolver processes malicious DNS replies from an upstream DNS server, allowing memory corruption, false cache entry injection, DNS redirection, and denial of service. The flaw affects code introduced in release `2.73` and is tied to unsafe `strcpy()` use during cache insertion after `extract_name()` converts DNS names from wire format into C strings, where escaped names can exceed the `1,025`-byte `bigname` heap buffer. Researchers reported practical exploitation against **OpenWRT 24.10.4** configured to use a malicious upstream resolver, using crafted requests and CNAME chains to corrupt the `bigname` free list, obtain a write-what-where primitive, and overwrite a function pointer in musl `ld.so` to gain instruction-pointer control. The issue was fixed on 11 May 2026 in versions `2.92rel2` and `2.93`, and public reporting warns that exposed deployments could face DNS hijacking or, under the demonstrated conditions, full remote code execution.
Jul 20, 2026