EUVD-2026-42866
GHSA-58vq-325m-3wrj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
DNS response interception requires attacker network positioning (AC:H); user must actively run mtr (UI:R); only mtr process crashes, no confidentiality or integrity impact.
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
1DescriptionCVE.org
mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME field. ipinfo_lookup() function uses the length of the response as the end-of-message boundary for dn_expand() function. The result is a reliable crash.
This issue exists in the mtr through version 0.96 and it was fixed in commit 48e1794414d338ce47abc0f27c25ade8788af9c3.
AnalysisAI
Out-of-bounds read in mtr's ipinfo_lookup() function allows a DNS-layer attacker to reliably crash the tool by serving a crafted TXT response during AS-number lookups. mtr through version 0.96 is affected; the root cause is that dn_expand() receives the total response length as its boundary argument rather than the safe, validated packet end - so a >512-byte response carrying a malicious compression pointer in the answer NAME field directs the read past the buffer. No public exploit code and no CISA KEV listing exist at time of analysis, though the crash is described as deterministic once the attacker controls the DNS response.
Technical ContextAI
mtr (My Traceroute) is a Unix network diagnostic utility that merges traceroute and ping into a single interface. When AS (Autonomous System) annotation is enabled, mtr calls ipinfo_lookup() to perform DNS TXT record queries that resolve hop IP addresses to AS numbers. The function passes the raw response buffer length - not a validated in-message boundary - as the msglen argument to the POSIX dn_expand() resolver helper. dn_expand() follows DNS name compression pointers (RFC 1035 §4.1.4) to reconstruct domain names; a crafted pointer can reference an offset beyond the legitimate packet data, causing dn_expand() to read out-of-bounds memory (CWE-125: Out-of-bounds Read). The 512-byte threshold is significant because responses larger than this cannot be delivered over standard UDP without DNS extensions, making the crafted packet deliberately oversized. No CPE string was provided in available data; the fix is upstream commit 48e1794414d338ce47abc0f27c25ade8788af9c3 in traviscross/mtr on GitHub.
RemediationAI
The upstream fix is available as commit 48e1794414d338ce47abc0f27c25ade8788af9c3 in the traviscross/mtr GitHub repository (https://github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af9c3); users should rebuild mtr from this commit or await a tagged release and a patched distribution package. As an immediate workaround, disabling AS-number lookups removes the vulnerable code path entirely - do not use the --aslookup flag (or equivalent configuration option) when invoking mtr; the trade-off is loss of AS annotation in route output, which is cosmetic for most diagnostic use cases. Restricting mtr's DNS resolution to a trusted, controlled internal resolver that cannot be influenced by external parties reduces the DNS-interposition attack surface without affecting functionality. On untrusted networks (public Wi-Fi, shared colocation), prefer running mtr over a VPN-tunneled path so DNS responses traverse a trusted channel. See the CERT.pl advisory at https://cert.pl/en/posts/2026/07/CVE-2026-14461 for additional context.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today