Trapster Community uncontrolled recursion in DNS label decoding

Executive brief

Trapster Community is a honeypot tool used to detect and log malicious network activity. A vulnerability in its DNS handling component allows an unauthenticated attacker to crash the DNS honeypot service by sending a single specially crafted network packet. This can lead to a denial of service, preventing the honeypot from monitoring or logging further DNS-based attacks.

Technical details

The `decode_labels` function in `trapster/libs/dns.py` fails to implement cycle detection or depth bounds when processing RFC 1035 DNS compression pointers. An attacker can send a UDP packet containing self-referential or deeply chained compression pointers to trigger a `RecursionError` in CPython. Because this exception is not caught within the `datagram_received` path, it propagates to the asyncio event loop, aborting the packet-handling task and causing sustained CPU consumption and log flooding. This vulnerability affects versions up to 1.2.0.

Affected products

• 0xBallpoint trapster <= 1.2.0

Timeline

• 2026-06-01: advisory: GitHub Advisory published
• 2026-07-08: disclosed: Vulnerability disclosed by researcher

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D