Reliance on Reverse DNS Resolution for a Security-Critical Action
CWE-350
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
We track 14 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: Use other means of identity verification that cannot be simply spoofed. Possibilities include a username/password or certificate.
- Implementation: Perform proper forward and reverse DNS lookups to detect DNS spoofing.
Latest Reliance on Reverse DNS Resolution for a Security-Critical Action vulnerabilities
- 8.3 High severity
sharpemu: Missing Authentication for Critical Functionality
SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend
- 8.8 High severity
anki-mcp-server-addon: Origin Validation Error
AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuri
- 8.1 High severity
rojo: Reliance on Reverse DNS Resolution for a Security-Critical Action
Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open()
- 9.6 Critical severity
gitlab-mcp: Reliance on Reverse DNS Resolution for a Security-Critical Action
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a vict
- 9.8 Critical severity
praisonaiagents: Missing Authentication for Critical Functionality
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation,
- 8.5 High severity
PraisonAI: Reliance on Reverse DNS Resolution for a Security-Critical Action
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permi
- 7.5 High severity
grav: Reliance on Reverse DNS Resolution for a Security-Critical Action
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled dom
- 7.5 High severity
datamodel-code-generator: Reliance on Reverse DNS Resolution for a Security-Critical Action
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamod
- 8.8 High severity
rust-sdk: Origin Validation Error
RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious publi
- 7.5 High severity
Jenkins: Reliance on Reverse DNS Resolution for a Security-Critical Action
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTT
- 7.4 High severity
Apache ZooKeeper: Improper Certificate Validation
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It
- 9.8 Critical severity
Spam protection, Honeypot, Anti-Spam by…: Reliance on Reverse DNS Resolution for a Security-Critical Action
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up t
- 8.1 High severity
Firefox: Reliance on Reverse DNS Resolution for a Security-Critical Action
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
- 8.8 High severity
spacex_starlink_wi_fi_router_gen_2: Reliance on Reverse DNS Resolution for a Security-Critical Action
SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Rebinding attack.