CVE-2026-82309

Name of the Vulnerable Software and Affected Versions Robots::Validate versions 0.3.2 through 0.3.10

Description An issue exists where the software allows unbounded outbound DNS queries during validation through a forward-confirmation loop. The check dns() function issues a PTR query for the client address and subsequently issues a forward query for every returned name matching the rule's domain until one resolves back to that address. Because there is no limit on the number of names queried and a client can control the reverse zone for its own address, a malicious actor can trigger an excessive number of synchronous queries. This process bypasses local caches as each forward name is distinct, forcing resolution against authoritative servers and causing the caller to be held until all queries answer or time out.

Recommendations Update to version 0.3.11.