The vulnerability occurs because Froxlor’s LOC record validation regex accepts newline characters, the TLSA validator allows arbitrarily long hex data, and raw input is returned without zone-file escaping. Attackers can exploit these weaknesses by injecting newline characters or unbounded hexadecimal strings into DNS records or other configuration fields, thereby corrupting zone files or inserting malicious data. The impact of this manipulation is a loss of data integrity and confidentiality for DNS resolution, potentially enabling domain hijacking or service disruption. This flaw is identified with CWE‑74, representing improper validation or sanitization of user input.

Froxlor server administration software released by the froxlor project. Versions 2.3.6 and earlier contain the full set of validation problems. Version 2.3.7 includes a patch, but the advisory notes that the fix was incomplete for the earlier CVE‑2026‑30932 issue; administrators should be sure they are running a release that has all registered fixes.

The CVSS score of 8.6 indicates high severity, but the EPSS score is not available, so the likelihood of real‑world exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported yet. The most likely attack vector would require authenticated access to the Froxlor web interface with permission to create or modify DNS records. Successful exploitation could lead to data tampering or denial of service scenarios.