Detections
Analytics

Chainguard: synapse: security update to 1.164.1-r2

low Tenable Self-Hosted Container Security Plugin ID 478043

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to
 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its
 16-bit transaction ID matches but does not verify that the response came from the queried host and port.
 An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can
 inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each
 query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance
 expose only the transaction-ID search space after the first query. A successful forgery can redirect
 hostname resolution and enable mail interception, server-side request forgery, or man-in-the-middle
 positioning. This issue is fixed in version 26.10.0rc1. (CVE-2026-83813)

Solution

Update the synapse library and its related packages to version 1.164.1-r2 or later.

Plugin Details

Severity: Low

ID: 478043

Version: Revision 1.1

Type: Local

Published: 10/31/2026

Updated: 10/31/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 1.8

Temporal Score: 1.3

Vector: CVSS2#AV:A/AC:H/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-83813

CVSS v3

Risk Factor: Low

Base Score: 3.1

Temporal Score: 2.7

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/23/2026

Reference Information

CVE: CVE-2026-83813