CVE-2026-41237 Froxlor has an incomplete fix for CVE-2026-30932
Attackers can inject malformed DNS records due to incomplete input validation in Froxlor, potentially bypassing security checks or corrupting data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41237?
CVE-2026-41237 is a high-severity vulnerability in froxlor, published on 4 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines (allowing embedded newlines to pass), TLSA `matchingType=0` has no upper bound on hex data length, and all validators return raw input without zone-file escaping. Version 2.3.7 contains an updated patch.
Weakness: CWE-74
Which versions are affected by CVE-2026-41237?
2 open source packages ship an affected version, including froxlor/froxlor.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions | 2.3.7 |
froxlor/froxlor Packagist | All versions | 2.3.7 |
How do I fix CVE-2026-41237?
Upgrade froxlor/froxlor to 2.3.7 or later.
Is CVE-2026-41237 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41237 exists.
Sources
Also known as GHSA-j6fm-9rfm-j5hx.