Is CVE-2026-75514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75514 being exploited in the wild.

How severe is CVE-2026-75514?

Medium severity, with a CVSS score of 5.9, published 20 August 2026.

Which products and versions are affected?

Bunkerity BunkerWeb prior to 1.6.13.

Is there a fix for CVE-2026-75514?

A patch was published on 2026-07-08: Fix committed; released in version 1.6.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75514 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-75514?

Check whether you run Bunkerity BunkerWeb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75514: BunkerWeb rDNS spoofing bypass in blacklist/greylist/antibot

CVE-2026-75514 · Severity: medium · CVSS 5.9 · Published 2026-08-20

BunkerWeb is an open-source web application firewall that uses reverse DNS (rDNS) lookups to make trust decisions about incoming traffic, such as blocking or rate-limiting requests. An attacker who controls a PTR (reverse DNS) record can spoof a trusted domain suffix to bypass the firewall's blacklist, gain preferential treatment, or skip security challenges, effectively defeating these protective mechanisms.

Technologies: Bunkerity BunkerWeb. Vendors: Bunkerity.

Quick answers

Is CVE-2026-75514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75514 being exploited in the wild.
How severe is CVE-2026-75514?: Medium severity, with a CVSS score of 5.9, published 20 August 2026.
Which products and versions are affected?: Bunkerity BunkerWeb prior to 1.6.13.
Is there a fix for CVE-2026-75514?: A patch was published on 2026-07-08: Fix committed; released in version 1.6.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75514 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-75514?: Check whether you run Bunkerity BunkerWeb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insufficient validation flaw in the blacklist, greylist, and antibot modules (src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua). These modules trust rDNS PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without performing forward-confirm reverse DNS (FCrDNS) validation to verify that the hostname actually resolves back to the client's IP address. An unauthenticated remote attacker who controls a PTR record can set a malicious PTR to match a trusted suffix (e.g., ".googlebot.com") and bypass security controls. The vulnerability requires no authentication or special network access beyond control of a PTR record. The fix, deployed in version 1.6.13, implements FCrDNS validation to confirm hostname-to-IP mappings before honoring rDNS-based trust decisions.

Affected products

Bunkerity BunkerWeb prior to 1.6.13

Timeline

2026-08-20: disclosed
2026-07-08: patched: Fix committed; released in version 1.6.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.