CVE-2026-75514: BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot

Vulnerability summary

CVE-2026-75514 is a medium (CVSS 5.9) vulnerability in bunkerity bunkerweb. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.6% of scored vulnerabilities.

Timeline

1. 20-08-2026
   PublishedVulnerability first disclosed.
2. 20-08-2026
   Last modifiedVulnerability information updated.

Description

BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.

• CWE-350Reliance on Reverse DNS Resolution for a Security-Critical ActionThe product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.