CWE-350 · Authentication
Reliance on Reverse DNS Resolution for a Security-Critical Action
30CVEs
SortMost likely exploited
30 CVEs with CWE-350 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-22884Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts…NodeJS · Node · 2021-03-03 | – | 37% | 2021-03-03 |
| CVE-2018-7160The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious web…The Node.js Project · Node.js · 2018-05-17 | – | 9.5% | 2018-05-17 |
| CVE-2017-0902RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a ser…HackerOne · RubyGems · 2017-08-31 | – | 4.8% | 2017-08-31 |
| CVE-2026-1490Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installationcleantalk · Spam protection, Honeypot, Anti-Spam by CleanTalk · CVSS 9.8 · 2026-02-15 | 9.8 | 1.3% | 2026-02-15 |
| CVE-2021-34561A vulnerability in WirelessHART-Gateway <= 3.0.8 allows to bypass any IP or firewall based access restrictions through DNS rebindingPhoenix Contact · WHA-GW-F2D2-0-AS- Z2-ETH · CVSS 7.5 · 2021-08-31 | 7.5 | 0.9% | 2021-08-31 |
| CVE-2020-11091Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisementsweaveworks · Weave · CVSS 5.8 · 2020-06-03 | 5.8 | 0.9% | 2020-06-03 |
| CVE-2026-24281Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerApache Software Foundation · Apache ZooKeeper · CVSS 5.9 · 2026-03-07 | 5.9 | 0.7% | 2026-03-07 |
| CVE-2023-32020Windows DNS Spoofing VulnerabilityMicrosoft · Windows Server 2019 · CVSS 5.6 · 2023-06-13 | 5.6 | 0.7% | 2023-06-13 |
| CVE-2026-75514BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibotbunkerity · bunkerweb · CVSS 5.9 · 2026-08-20 | 5.9 | 0.6% | 2026-08-20 |
| CVE-2023-52235SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Rebinding attack.No vendor recorded · CVSS 8.8 · 2024-04-05 | 8.8 | 0.5% | 2024-04-05 |
| CVE-2022-22364IBM Cognos Controller security bypassIBM · Cognos Controller · CVSS 5.3 · 2024-05-03 | 5.3 | 0.5% | 2024-05-03 |
| CVE-2026-61568@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transportzereight · gitlab-mcp · CVSS 9.6 · 2026-09-15 | 9.6 | 0.5% | 2026-09-15 |
| CVE-2026-28271Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)kiteworks · security-advisories · CVSS 6.5 · 2026-02-27 | 6.5 | 0.5% | 2026-02-27 |
| CVE-2025-8036DNS rebinding circumvents CORSMozilla · Firefox · CVSS 8.1 · 2025-07-22 | 8.1 | 0.4% | 2025-07-22 |
| CVE-2026-56709Grav before 3.9.2 Host Header Injection via sendInvitationEmailgetgrav · grav · CVSS 7.5 · 2026-08-25 | 7.5 | 0.4% | 2026-08-25 |
| CVE-2025-59956AgentAPI exposed user chat history via a DNS rebinding attackcoder · agentapi · CVSS 6.5 · 2025-09-29 | 6.5 | 0.4% | 2025-09-29 |
| CVE-2025-59163vet MCP Server SSE Transport DNS Rebinding Vulnerabilitysafedep · vet · CVSS 2.1 · 2025-09-29 | 2.1 | 0.4% | 2025-09-29 |
| CVE-2026-61743Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validationchartbrew · chartbrew · CVSS 6.3 · 2026-09-21 | 6.3 | 0.4% | 2026-09-21 |
| CVE-2026-55526PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)MervinPraison · PraisonAI · CVSS 8.5 · 2026-08-25 | 8.5 | 0.4% | 2026-08-25 |
| CVE-2026-53708ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)IBM · mcp-context-forge · CVSS 6.6 · 2026-09-14 | 6.6 | 0.4% | 2026-09-14 |
| CVE-2026-33002Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by co…Jenkins Project · Jenkins · CVSS 7.5 · 2026-03-18 | 7.5 | 0.3% | 2026-03-18 |
| CVE-2026-55391datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebindingkoxudaxi · datamodel-code-generator · CVSS 7.5 · 2026-07-28 | 7.5 | 0.3% | 2026-07-28 |
| CVE-2025-24010Vite allows any websites to send any requests to the development server and read the responsevitejs · vite · CVSS 6.5 · 2025-01-20 | 6.5 | 0.3% | 2025-01-20 |
| CVE-2024-53275GHSL-2024-091: DNS rebinding attack in home-galleryxemle · home-gallery · CVSS 5.3 · 2024-12-23 | 5.3 | 0.3% | 2024-12-23 |
| CVE-2026-97875DNS rebinding vulnerability in rojo serve HTTP APIrojo-rbx · rojo · CVSS 8.1 · 2026-09-25 | 8.1 | 0.3% | 2026-09-25 |
| CVE-2024-42364homepage DNS rebinding vulnerability (GHSL-2024-096)gethomepage · homepage · CVSS 6.5 · 2024-08-23 | 6.5 | 0.3% | 2024-08-23 |
| CVE-2026-6874ericc-ch copilot-api Header token dns rebindingericc-ch · copilot-api · CVSS 4.3 · 2026-04-22 | 4.3 | 0.3% | 2026-04-22 |
| CVE-2025-61430Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request payloads from other c…No vendor recorded · CVSS 6.5 · 2025-10-24 | 6.5 | 0.3% | 2025-10-24 |
| CVE-2026-36604Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a domain to…No vendor recorded · CVSS 6.5 · 2026-06-03 | 6.5 | 0.3% | 2026-06-03 |
| CVE-2026-12635Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLabGitLab · GitLab · CVSS 0 · 2026-06-25 | 0.0 | 0.2% | 2026-06-25 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.