{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "4.3.0"
              },
              {
                "fixed": "4.3.1"
              },
              {
                "introduced": "4.4.0"
              },
              {
                "fixed": "4.4.1"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "3568e1b6d5cdd51a6b964a2a1d6d29200fea2056"
            },
            {
              "fixed": "75f67d766726351b30199f9a2bf55803d717a3be"
            },
            {
              "introduced": "684c9e8f32e4373a21098559f748f06915f950c9"
            },
            {
              "fixed": "1f6485eca25431b5ff27ce9a754218c9e559bbbb"
            }
          ],
          "repo": "https://github.com/zephyrproject-rtos/zephyr",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-3jxq-xx8g-q8j2"
  ],
  "database_specific": {
    "cna_assigner": "zephyr",
    "cwe_ids": [
      "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10652.json"
  },
  "details": "Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in dns_unpack_answer(), which validated only the fixed RR header (type, class, TTL, rdlength) and accepted any attacker-declared rdlength, including one extending past the end of the received datagram. The TXT and SRV consumers in dns_validate_record() (resolve.c) then read up to rdlength bytes (clamped only to a record-type maximum such as DNS_MAX_TEXT_SIZE, default 64, not to the packet) from the receive buffer via memcpy without their own bounds check, and pass the result to the application's resolve callback. A malicious or spoofed DNS server, an on-path attacker forging UDP DNS replies, or (with mDNS/LLMNR enabled) any LAN node can craft a truncated TXT or SRV response that causes an out-of-bounds read of adjacent receive-pool memory; the disclosed stale bytes (residual contents of prior DNS packets / uninitialized pool memory) are returned to the application as TXT/SRV record contents, an information leak, and may in some configurations cross the allocation boundary and fault, causing a denial of service. The read is bounded (~64 bytes for TXT, ~6 for SRV) and read-only (no write). The fix rejects any record whose declared rdata extends past dns_msg-\u003emsg_size at the single chokepoint in dns_unpack_answer(). Affected: v4.3.0 and v4.4.0.",
  "id": "CVE-2026-10652",
  "modified": "2026-10-17T02:30:23.679275778Z",
  "published": "2026-06-30T15:50:46.510Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10652.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3jxq-xx8g-q8j2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10652"
    },
    {
      "type": "FIX",
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/58b46c81c6796dac4dc7391f32ba006474f94dc8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zephyrproject-rtos/zephyr"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)"
}