CVE-2026-75514: BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot
BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORERDNS, GREYLISTRDNS, and ANTIBOTIGNORERDNS without using getips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BunkerWebto a version that resolves this vulnerability.Fixed in 1.6.13
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
BunkerWeb versions prior to 1.6.13 are affected when they use rDNS-based entries in IGNORE_RDNS, GREYLIST_RDNS, or ANTIBOT_IGNORE_RDNS. The issue applies to the blacklist, greylist, and antibot modules.
What does an attacker need to exploit the bypass?
An unauthenticated remote attacker needs control of a PTR record that matches a trusted hostname suffix configured in one of the affected rDNS settings. Because the hostname was not forward-confirmed against the client IP address, the attacker can spoof the trusted suffix.
What security controls can be bypassed?
An attacker may bypass rDNS-based blacklisting, receive greylist treatment, or avoid an antibot challenge, depending on which affected setting is configured. Integrity impact is rated high, while confidentiality and availability impacts are rated none.
What should be done if an immediate upgrade is not possible?
Remove or avoid relying on rDNS suffix entries in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS until the instance can be updated. The available fix is BunkerWeb version 1.6.13.