CVE-2026-112273
Description
A flaw was found in libtins. A heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer or authority records trigger a one-byte read when parsed, resulting in a denial of service.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict boundary checks before pointer dereference in DNS::compose_name when parsing DNS labels in libtins: upgrade to the fixed Libtins builds, which validates that parsing pointers remain strictly within records buffer boundaries before dereferencing so that labels terminating at the buffer end do not trigger out-of-bounds reads, closing all 3 injection vectors (crafted DNS packet terminating at the end of a label, crafted DNS additional records, crafted DNS answer or authority records). Until patched, this is a concern on Applications on any platform using libtins to parse or dissect incoming DNS packets, so restrict network access to applications dissecting DNS packets with libtins and filter or drop malformed DNS traffic at network perimeters. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap out-of-bounds read defect — apply the upstream patch to fully remediate.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
