Live › vulnerability › CVE-2026-112273
Go to dashboardlibtins is a C++ packet-sniffing and crafting library, and its DNS name parser reads one byte past the end of the packet buffer when a label ends exactly at the packet end. A remote attacker who sends a crafted DNS packet can crash applications that parse it, especially on hardened allocators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that link libtins and parse DNS packets from untrusted networks are exposed, since the malformed record is read during parsing. Teams that do not use libtins, or that only feed it trusted traffic, can skip it. The sources do not name a fixed version.
No product ranges from the sources yet.
grep -ri libtins in the build files or ldd on binaries that link it.4.6 as affected.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority records trigger a one-byte read when parsed, crashing applications on hardened allocators.
This page as .md · .json · in your agent: get_signal("CVE-2026-112273")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.