CVE-2026-75514

MEDIUM 5.9

BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.

CWE	CWE-350
Vendor	bunkerity
Product	bunkerweb
Published	Aug 20, 2026
Last Updated	Aug 20, 2026

Stay Ahead of the Next One

Get instant alerts for bunkerity bunkerweb

Be the first to know when new medium vulnerabilities affecting bunkerity bunkerweb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

bunkerity / bunkerweb

< 1.6.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm github.com: https://github.com/bunkerity/bunkerweb/pull/3710 github.com: https://github.com/bunkerity/bunkerweb/commit/1a97e5b3f977130a1b84507a9e1f703c8eec12eb github.com: https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.13