CVE-2026-41237 Details
Description
Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines (allowing embedded newlines to pass), TLSA `matchingType=0` has no upper bound on hex data length, and all validators return raw input without zone-file escaping. Version 2.3.7 contains an updated patch.
A vulnerability exists in Froxlor versions through 2.3.6, where the validation of certain DNS record types (LOC, RP, SSHFP, and TLSA) is inadequate. The LOC record regex allows embedded newlines to pass, creating a risk of DNS zone file injection. Additionally, the TLSA 'matchingType=0' has no upper limit on hex data length, potentially leading to abuse. This lack of proper validation allows for the injection of arbitrary content into DNS records, which is then written directly into BIND9 zone files, facilitating various attacks such as domain hijacking or phishing.
Users can update to Froxlor version 2.3.7, which addresses the vulnerability by implementing proper validation for DNS records. However, the patch is incomplete, as it does not fully sanitize LOC records or impose a limit on TLSA data length.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-j6fm-9rfm-j5hx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/froxlor/froxlor/commit/b34829262dc3 | [email protected] | Source CodeVendor |
| https://github.com/froxlor/froxlor/releases/tag/2.3.7 | [email protected] | Release NotesVendor |
| https://github.com/froxlor/froxlor/security/advisories/GHSA-j6fm-9rfm-j5hx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Froxlor | <= 2.3.6 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |