CVE-2026-5772CWE-126

MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname Validation

Low · published April 9, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname validation when the LEFT_MOST_WILDCARD_ONLY flag is active. If a wildcard * exhausts the entire hostname string, the function reads one byte past the buffer without a bounds check, which could cause a crash.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00347 · 27.1th percentile
Weakness
CWE-126 · Buffer Over-read
Published
2026-04-09T21:50Z
EPSS history
Timeline
  • 09 APR 21:50Z
    MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname Validation
    cvelistv5