Description
Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines (allowing embedded newlines to pass), TLSA `matchingType=0` has no upper bound on hex data length, and all validators return raw input without zone-file escaping. Version 2.3.7 contains an updated patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| froxlor | froxlor | < 2.3.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | froxlor/froxlor | < 2.3.7 | 2.3.7 | GHSA-j6fm-9rfm-j5hx |
Advisories 1
- WID-SEC-2026-1737 Froxlor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 14, 2026