mtr network tool patches DNS crash bug
A crafted DNS TXT response can crash mtr's ipinfo_lookup() via an out-of-bounds read, patched in commit 48e17944.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-14461, an out-of-bounds read vulnerability in the popular network diagnostic tool mtr. The flaw resides in the ipinfo_lookup() function, which is used for AS (Autonomous System) lookups via DNS TXT queries. An attacker capable of influencing the TXT response returned to a victim running mtr can trigger the bug by supplying a DNS response larger than 512 bytes containing a crafted compression pointer in the answer NAME field. Because ipinfo_lookup() incorrectly uses the response length as the boundary for the dn_expand() function, this leads to a reliable out-of-bounds read and application crash.
The vulnerability affects all versions of mtr through 0.96 and has been fixed upstream in commit 48e1794414d338ce47abc0f27c25ade8788af9c3. The issue was responsibly reported by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team, and CERT Polska facilitated the coordinated disclosure process. There is no indication of active exploitation in the wild; this is a denial-of-service class bug requiring an attacker to control or spoof the DNS TXT response used during AS lookups, limiting practical attack scenarios to on-path or malicious DNS server positions.
Users of mtr should upgrade to a patched version incorporating the referenced fix. Given the limited impact (a crash/DoS rather than code execution) and the absence of in-the-wild exploitation, this issue poses a low operational risk but should still be remediated as part of standard patch management.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-14461
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs