CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
A kind of CWE-290 Authentication Bypass by Spoofing.
From the CWE List. © The MITRE Corporation.
Newest
- sharpemu SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution 8.3 High
- ankimcp anki-mcp-server-addon AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools 8.8 High
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 more Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header 6.4 Medium
- chartbrew Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation 6.3 Medium
- zereight gitlab-mcp @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport 9.6 Critical
- mervinpraison praisonai, praisonaiagents +1 more PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) 8.5 High
- getgrav grav Grav before 3.9.2 Host Header Injection via sendInvitationEmail 8.7 High
- bunkerity bunkerweb BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot 5.9 Medium
- ibm mcp-context-forge, mcp-contextforge-gateway +1 more ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`) 6.6 Medium
- modelcontextprotocol ruby-sdk MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection 6.9 Medium
- koxudaxi datamodel-code-generator datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding 7.5 High
- gitlab Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab 0.0 None
- nicolargo glances Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack 5.3 Medium
- mervinpraison praisonaiagents PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in 9.8 Critical
- No product listed Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host... 6.5 Medium
- rojo-rbx rojo DNS rebinding vulnerability in rojo serve HTTP API 8.1 High
- modelcontextprotocol rust-sdk RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport 8.8 High
- ericc-ch copilot-api ericc-ch copilot-api Header token dns rebinding 5.3 Medium
- openclaw OpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass 4.9 Medium
- openclaw OpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery 5.9 Medium
- jenkins Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation 7.5 High
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 more Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager 7.4 High
- accellion kiteworks, kiteworks security-advisories +1 more Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF) 6.5 Medium
- cleantalk spam protection, honeypot, anti-spam by cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation 9.8 Critical
- lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost 7.6 High
- lfprojects mcp typescript sdk, modelcontextprotocol typescript-sdk +1 more DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost 7.6 High
- No product listed Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying... 6.5 Medium
- coder agentapi AgentAPI exposed user chat history via a DNS rebinding attack 6.5 Medium
- safedep vet vet MCP Server SSE Transport DNS Rebinding Vulnerability 2.1 Low
- mozilla firefox, thunderbird +1 more DNS rebinding circumvents CORS 8.1 High
- vitejs vite Vite allows any websites to send any requests to the development server and read the response 6.5 Medium
- xemle home-gallery GHSL-2024-091: DNS rebinding attack in home-gallery 5.3 Medium
- mindsdb MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding 9.3 Critical
- gethomepage homepage homepage DNS rebinding vulnerability (GHSL-2024-096) 6.5 Medium
- ibm cognos controller IBM Cognos Controller security bypass 5.3 Medium
- ollama Ollama DNS rebinding vulnerability 6.6 Medium
- spacex starlink wi fi router gen 2 starlink wi fi router gen 2 SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722... 8.8 High
- wiremock studio, wiremock, wiremock docker +1 more +3 more Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio 3.9 Low
- microsoft windows server 2008 service pack 2, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +12 more +14 more Windows DNS Spoofing Vulnerability 5.6 Medium
- pepperl-fuchs wha-gw-f2d2-0-as-z2-eth.eip firmware, wha-gw-f2d2-0-as-z2-eth firmware, phoenix contact wha-gw-f2d2-0-as- z2-eth +1 more +3 more A vulnerability in WirelessHART-Gateway <= 3.0.8 allows to bypass any IP or firewall based access restrictions through DNS rebinding 7.5 High
- nodejs node, node.js, fedoraproject fedora +11 more +13 more Node.js bad 7.5 High
- weave net, weaveworks weave +1 more Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements 5.8 Medium
- node.js Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding 8.8 High
- etcd-io etcd, fedoraproject fedora +1 more DNS Rebinding in etcd 5.5 Medium
- hackerone rubygems, canonical ubuntu linux, debian linux +6 more +8 more RubyGems has Origin Validation Error vulnerability 8.1 High
- ruby-lang ruby, rubygems, oracle solaris +1 more +3 more RubyGems vulnerable to DNS hijack attack 5.0 Medium