{"id":"CVE-2026-112273","kind":"vulnerability","aliases":["CVE-2026-112273"],"related":[],"title":"libtins: crafted DNS packet causes one-byte heap out-of-bounds read","description":"libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority records trigger a one-byte read when parsed, crashing applications on hardened allocators.","summary":"libtins is a C++ packet-sniffing and crafting library, and its DNS name parser reads one byte past the end of the packet buffer when a label ends exactly at the packet end. A remote attacker who sends a crafted DNS packet can crash applications that parse it, especially on hardened allocators.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","libtins","network-tools","package","packet-parsing"],"not_affected_if":["no-libtins-dependency","trusted-traffic-only"],"how_to_check":"- Check whether the project depends on libtins, for example with `grep -ri libtins` in the build files or `ldd` on binaries that link it.\n- Confirm the installed version, and treat anything at or below `4.6` as affected.","fix":null,"status":"open","published_at":"2026-10-19T14:17:05+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:40:53+00:00","updated_at":"2026-10-25T03:40:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"libtins: crafted DNS packet causes one-byte heap out-of-bounds read","impact":"low","summary":"libtins is a C++ packet-sniffing and crafting library, and its DNS name parser reads one byte past the end of the packet buffer when a label ends exactly at the packet end. A remote attacker who sends a crafted DNS packet can crash applications that parse it, especially on hardened allocators.","category":"package","nicknames":[],"who_cares":["c++","libtins","network-tools","packet-parsing"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote crash of parsing application via one-byte heap over-read","analyst_note":"Find the upstream libtins fix version and commit for DNS::compose_name in src/dns.cpp; the sources give no patched release.","how_to_check":"- Check whether the project depends on libtins, for example with `grep -ri libtins` in the build files or `ldd` on binaries that link it.\n- Confirm the installed version, and treat anything at or below `4.6` as affected.","needs_analyst":true,"not_affected_if":["no-libtins-dependency","trusted-traffic-only"],"who_is_affected":"Applications that link libtins and parse DNS packets from untrusted networks are exposed, since the malformed record is read during parsing. Teams that do not use libtins, or that only feed it trusted traffic, can skip it. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000607,"input_tokens":3362,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112273':17A,20A '-2026':16A,19A '4.6':85C 'addit':128C 'alloc':82B,145C 'allow':102C 'answer':129C 'applic':75B,142C 'attack':66B,104C,121C 'author':131C 'bound':13A,92C 'buffer':54B,110C 'byte':8A,47B,137C 'c':21B,33B 'caus':5A 'compos':97C 'contain':86C 'craft':2A,38B,70B,124C 'crash':74B,141C 'cve':15A,18A 'deliv':123C 'dns':3A,42B,71B,96C,125C 'end':50B,58B,63B,115C,120C 'especi':79B 'exact':59B,116C 'harden':81B,144C 'heap':9A,88C 'label':57B,114C 'librari':39B 'libtin':1A,22B,30B,83C 'name':43B,98C 'network':24B 'network-tool':23B 'one':7A,46B,136C 'one-byt':6A,135C 'out-of-bound':10A,89C 'packag':26B 'packet':4A,28B,35B,53B,62B,72B,109C,119C,126C 'packet-pars':27B 'packet-snif':34B 'pars':29B,77B,140C 'parser':44B 'past':48B,107C 'read':14A,45B,93C,106C,138C 'record':132C 'remot':65B,103C 'send':68B,112C 'snif':36B 'src/dns.cpp':100C 'tool':25B 'trigger':133C 'vulner':94C 'whose':127C","nicknames":[],"mitigations":[],"who_affected":"Applications that link libtins and parse DNS packets from untrusted networks are exposed, since the malformed record is read during parsing. Teams that do not use libtins, or that only feed it trusted traffic, can skip it. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112273","severity":null,"published_at":"2026-10-19T14:17:05+00:00","modified_at":"2026-10-22T03:16:36+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}