{"items":[{"id":"NVI-00017768","kind":"vulnerability","title":"Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mxwc-wh95-pw4g"],"plain_summary":"GitHub lists this reviewed advisory for trapster. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5f6fd94ab91b39ef21ff3d1451ef394d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-08T20:24:46.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5f6fd94ab91b39ef21ff3d1451ef394d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5f6fd94ab91b39ef21ff3d1451ef394d","url":"https://github.com/advisories/GHSA-mxwc-wh95-pw4g","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mxwc-wh95-pw4g","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:34:51.634Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5f6fd94ab91b39ef21ff3d1451ef394d"],"technology":"trapster","known_exclusions":[],"conditions_summary":"## Summary\n\n`trapster.libs.dns.decode_labels()` decodes DNS names from attacker-supplied UDP packets and recurses **once per RFC 1035 compression pointer** with **no cycle detection and no depth bound**. A single unauthenticated UDP datagram sent to the DNS honeypot drives the function past CPython's recursion limit, raising `RecursionError`. That exception is not handled anywhere on the `datagram_received` path, so it escapes into the asyncio event loop's default exception handler, the per-packet proxy task is never created, and a low-rate flood produces sustained CPU burn and log flooding (denial of service of the DNS honeypot module).\n\n## Severity\n\nMedium (CVSS:3.1 `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`). Network-reachable, unauthenticated, single-packet, availability-only against the DNS honeypot listener.\n\n## Affected component\n\n- File: `trapster/libs/dns.py`, function `decode_labels()` (called by `decode_question_section` → `decode_dns_message`).\n- Reached from: `trapster/modules/dns.py`, `DnsUdpProtocol.datagram_received()` → `dns.decode_dns_message(data)`, where `data` is the raw attacker UDP payload received by `DnsHoneypot` on its configured bind address/port.\n- Version te","public_affected_ranges":["<= 1.2.0"]}],"null_published_at":"2026-11-05T19:10:21.465Z","source_updated_at":"2026-07-08T20:24:46.000Z","source_disclosed_at":"2026-07-08T20:24:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:34:51.634Z"}],"next_cursor":null,"snapshot_revision":"44495"}