#1144898 syncthing: possible DNS-rebind attack detected: stun.syncthing.net

Package:
syncthing
Source:
syncthing
Description:
decentralized file synchronization
Submitter:
Henrik Ahlgren
Date:
2026-08-20 05:53:02 UTC
Severity:
normal
#1144898#5
Date:
2026-08-20 05:42:34 UTC
From:
To:
Dear Maintainer,

The old primary STUN server, stun.syncthing.net, has been discontinued
and removed from more recent syncthing versions (upstream commit
e5b72da60742a65423e52e8ffd0166c9ed6f2c48). However, for some reason,
the DNS name still resolves to 192.0.2.42 (an RFC1918 private
address).

This triggers a flood of warnings such as “possible DNS-rebind attack
detected: stun.syncthing.net” in dnsmasq on, for example, OpenWRT
routers, and likely something similar on other routers and firewalls.

Please consider dropping stun.syncthing.net from the Debian version.

Henrik