CVE-2026-75514: CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action in bunkerity bunkerweb

BunkerWeb, an open-source Web Application Firewall, contains a security weakness in its blacklist, greylist, and antibot modules prior to version 1.6.13. These modules trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without confirming that the hostname resolves to the client IP address using get_ips. This reliance on reverse DNS resolution (CWE-350) allows an unauthenticated remote attacker who controls a PTR record to spoof trusted suffixes, thereby bypassing rDNS-based blacklisting, gaining greylist treatment, or skipping antibot challenges. The vulnerability is addressed in version 1.6.13.

An attacker who can control a PTR record can bypass security controls based on reverse DNS suffix matching, potentially allowing them to evade blacklisting, greylisting, or antibot protections. This could lead to unauthorized access or reduced effectiveness of these security mechanisms. There is no confidentiality or availability impact indicated. The CVSS score is 5.9 (medium severity) with no privileges required and high attack complexity.

Upgrade BunkerWeb to version 1.6.13 or later, where this issue is fixed by verifying that the hostname resolves back to the client IP address before trusting PTR suffix matches. No other mitigation or workaround is indicated.