The flaw resides in BunkerWeb's blacklist, greylist, and antibot components, which validate reverse DNS suffixes from the IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS lists without performing a forward DNS confirmation. This omission allows an attacker who can modify a PTR record to bind a trusted suffix to a different IP address, thereby evading rDNS‑based blocking, gaining benign treatment, or bypassing antibot tests. The vulnerability is exploitable by unauthenticated remote actors with control over reverse DNS records.

All instances of BunkerWeb built before version 1.6.13 are affected, regardless of deployment environment. The vulnerability is tied to the core modules located in src/common/core/blacklist, src/common/core/greylist, and src/common/core/antibot. Users running the open‑source Web Application Firewall should check that the installed package is older than v1.6.13 and that the modules have not been patched manually.

This issue carries a CVSS score of 5.9, indicating a moderate risk level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying that it has not yet been reported as exploited in the wild. Nevertheless, the attack vector is remote and requires only control over a PTR record, a capability that can be exercised by a compromised DNS provider or a malicious insider. Until the upgrade is applied, the risk remains that legitimate traffic could be incorrectly handed and malicious traffic could slip through the firewall.