libtins versions up to 4.6 contain an out-of-bounds read in the DNS::soa_record::init function. When an attacker supplies SOA RDATA that does not end with a NUL byte, the library uses strlen to determine the string length, which can read past the allocated buffer. This can lead to the application reading sensitive memory and potentially crashing, resulting in denial of service.

The affected software is the libtins networking library, specifically all releases through 4.6. Applications that link against libtins and process DNS packets are exposed to this flaw.

The CVSS score of 6.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by sending crafted DNS packets to any service using libtins to parse SOA records. The impact is read exposure and possible crash, but the information disclosed is limited to the memory content that happens to be read by the untrusted strlen call. The lack of a code‑execution vector keeps the risk lower than an RCE, but the DoS potential means that the flaw should be mitigated promptly.