EUVD-2026-102339

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in servicesunboundacls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields...

CVE-2026-111227

Netgate pfSense CE through version 2.9.0 is vulnerable to a CRLF injection vulnerability in the services_unbound_acls.php component. Authenticated users possessing the DNS Resolver: Access Lists privilege can inject Unbound configuration directives by embedding CR/LF characters in the aclname or ...

CVE-2026-111227 Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in servicesunboundacls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields...

CVE-2026-111227

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in servicesunboundacls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields...

CVE-2026-111227: Improper Neutralization of CRLF Sequences

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in servicesunboundacls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields...

PT-2021-3126

Name of the Vulnerable Software and Affected Versions nginx versions 1.20.0 Description A security issue in the nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause a 1-byte memory overwrite, resulting in a worker process crash...