CVE-2026-111228

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in servicesunboundadvanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sockqueuetimeout parameter...

CVE-2026-111228 Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in servicesunboundadvanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sockqueuetimeout parameter...

EUVD-2026-102340

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in servicesunboundadvanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sockqueuetimeout parameter...

CVE-2026-111228

Netgate pfSense CE versions 2.7.1 through 2.9.0 are vulnerable to a CRLF injection vulnerability in services_unbound_advanced.php. Authenticated users possessing the DNS Resolver: Advanced privilege can exploit this by embedding CR/LF characters into the unvalidated sock_queue_timeout parameter. ...