# DNS rebinding past hostname allowlists

Hostname checked once, re-resolved at request time, letting DNS answers diverge between check and use

_Area: Web infrastructure and server-side requests. Seen in 8 disclosed reports; 2 confirmed bounties: $100 and $500; latest 2025-10-08. Updated 2026-10-23._

## How it works
A validator resolves a hostname, approves the resulting IP, then hands the hostname (not the pinned IP) to the fetcher, which resolves it again. If the attacker controls DNS, the first answer is public and the second is loopback or link-local. The broken assumption: a hostname maps to one stable address across the check and the use. Any allowlist or blocklist keyed on a name is only as trustworthy as the resolver's consistency between those two moments.

## Where it shows up
- URL-fetch, webhook, callback, or media-import features that validate a hostname then pass the hostname to a fetcher or proxy [E2](https://bugbountylibrary.com/r/h1%3A530974.md)[E4](https://bugbountylibrary.com/r/h1%3A53004.md)[E6](https://bugbountylibrary.com/r/h1%3A1379656.md)[E8](https://bugbountylibrary.com/r/h1%3A541169.md)
- Allowlist entries not guaranteed to resolve locally, e.g. `localhost6`, an /etc/hosts alias absent in many images, so it falls through to DNS [E1](https://bugbountylibrary.com/r/h1%3A1069487.md)
- Validators that return early on DNS resolution error, leaving the hostname unpinned [E3](https://bugbountylibrary.com/r/h1%3A632101.md)
- Localhost-bound dev/agent servers (MCP, IDE, torrent/file servers) with no Origin or Host validation [E5](https://bugbountylibrary.com/r/h1%3A3176157.md)[E7](https://bugbountylibrary.com/r/h1%3A663729.md)

## How to review
Trace the full path from validation to the actual connection. The invariant: the exact IP that passed the check must be the IP connected to, with no re-resolution in between. Concretely, log the resolved IP at validation and the connected IP at request time and compare them; or hook the resolver and confirm it is called once. Check every allowlist entry resolves locally (present in hosts, or a literal loopback address), not a name that can fall through to DNS [E1](https://bugbountylibrary.com/r/h1%3A1069487.md). Check the error path: a resolution failure must not skip pinning [E3](https://bugbountylibrary.com/r/h1%3A632101.md). For localhost services, confirm Origin/Host checks and CORS restrictions exist, not just a loopback bind [E5](https://bugbountylibrary.com/r/h1%3A3176157.md)[E7](https://bugbountylibrary.com/r/h1%3A663729.md).

## Variants seen
- Allowlist entry resolving over DNS instead of locally, defeating rebinding protection [E1](https://bugbountylibrary.com/r/h1%3A1069487.md)
- Validator checks IP, downstream proxy re-resolves independently [E4](https://bugbountylibrary.com/r/h1%3A53004.md)
- Validator pins IP, HTTP client re-resolves at request time [E8](https://bugbountylibrary.com/r/h1%3A541169.md)
- Early return on resolution error skips pinning [E3](https://bugbountylibrary.com/r/h1%3A632101.md)
- Server-side browser fetcher re-resolves while rendering attacker HTML [E2](https://bugbountylibrary.com/r/h1%3A530974.md)
- Webhook delivery re-resolves after validation-time block [E6](https://bugbountylibrary.com/r/h1%3A1379656.md)
- Localhost server with no Host/Origin check, driven from a browser page [E5](https://bugbountylibrary.com/r/h1%3A3176157.md)[E7](https://bugbountylibrary.com/r/h1%3A663729.md)

## Why fixes fail
E1 is an insufficient fix of an earlier CVE: a rebinding whitelist was added but included a name that still resolves via DNS. E3 shows a pinning fix that skips the error path. E4 and E8 show that pinning at the validator is useless if the fetcher resolves again. Adding a name-based allowlist, or pinning only on the success path, leaves the same gap.

## Impact and severity
Reached loopback services and internal networks [E2](https://bugbountylibrary.com/r/h1%3A530974.md)[E4](https://bugbountylibrary.com/r/h1%3A53004.md)[E5](https://bugbountylibrary.com/r/h1%3A3176157.md)[E6](https://bugbountylibrary.com/r/h1%3A1379656.md)[E7](https://bugbountylibrary.com/r/h1%3A663729.md), GCP metadata with SSH keys and service-account tokens [E2](https://bugbountylibrary.com/r/h1%3A530974.md), and in E1 the Node debugger, leading to RCE. Severity rises when the reached service is privileged (debugger, metadata, internal admin) or exposes powerful tools [E5](https://bugbountylibrary.com/r/h1%3A3176157.md). Bounties were modest (median 300), but impact ranged to RCE.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1069487.md
- E2: https://bugbountylibrary.com/r/h1%3A530974.md
- E3: https://bugbountylibrary.com/r/h1%3A632101.md
- E4: https://bugbountylibrary.com/r/h1%3A53004.md
- E5: https://bugbountylibrary.com/r/h1%3A3176157.md
- E6: https://bugbountylibrary.com/r/h1%3A1379656.md
- E7: https://bugbountylibrary.com/r/h1%3A663729.md
- E8: https://bugbountylibrary.com/r/h1%3A541169.md