CVE catalog

CVE-2026-1425

smartdns: CVE-2026-1425

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 25, 2026

A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the component SVBC Record Parser. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The patch is identified as 2d57c4b4e1add9b4537aeb403f794a084727e1c8. Applying a patch is advised to resolve this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansmartdnssid48.3+dfsg-1fixed
Debiansmartdnsforky48.3+dfsg-1fixed
Debiansmartdnstrixie46.1+dfsg-1.1~deb13u1fixed
Debiansmartdnsbookworm40+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansmartdnssourcesid46.1+dfsg-1.1not yet assignedNot reported[1126538]
Debiansmartdnssourceforky46.1+dfsg-1.1not yet assignedNot reported[1126538]
Debiansmartdnssourcetrixie46.1+dfsg-1.1~deb13u1not yet assignedNot reported[1126538]
Debiansmartdnssourcebookworm(unfixed)not yet assignedNot reported[1126538]

[Debian bug #1126538]

Notes

[bookworm] smartdns: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [smartdns]Affected
    Details (2)

    • 40+dfsg-1 · amd64 · bookworm

      Affected

      dsa · smartdns · debian · bookworm; dsa · smartdns · debian · 12

    • 40+dfsg-1 · arm64 · bookworm

      Affected

      dsa · smartdns · debian · bookworm; dsa · smartdns · debian · 12

[Debian 13 (Trixie)]

  • [smartdns]Fixed
    Details (2)

    • 46.1+dfsg-1.1~deb13u1 · amd64 · trixie

      Fixed · Fixed: 46.1+dfsg-1.1~deb13u1

      dsa · smartdns · debian · 13

    • 46.1+dfsg-1.1~deb13u1 · arm64 · trixie

      Fixed · Fixed: 46.1+dfsg-1.1~deb13u1

      dsa · smartdns · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]