Post #1994566
2026-03-26 21:23 UTC
@drewtowler @mdreid 1) Name compression and offset handling (all DNS software was buggy in the past about that, confusing = and & when testing specific bits) and 2) bitsquatting (either from space rays or humans)
Replies (1)
-
@pmevzek@framapiaf.org 2026-04-01 00:06
@drewtowler @mdreid "Proof": https://www.0xkato.xyz/CVE-2026-1678-DNS-Parser-Overflow-in-Zephyr/ "critical out-of-bounds write in Zephyr’s DNS name parser, dns_unpack_name()". My lemmas remain that 1) any given software dealing with DNS will have a bug related to parsing and 2) any given software dealing with text will have a bug related to Unicode complexity. Works. All. The. Time.