Live › vulnerability › CVE-2026-112274
Go to dashboardlibtins is a C++ networking library whose DNS SOA record parser calls strlen on attacker-supplied data without checking for a NUL terminator. A remote sender can make it read past the heap buffer, which can crash the application and may expose adjacent memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that link libtins and parse DNS SOA records from untrusted network traffic through the buffer constructor of DNS::soa_record::init. Programs that do not parse DNS responses from untrusted sources, or that do not use libtins, can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-112274")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.