https://vulnogram.org/ Most recent CVEs assigned by NLnet Labs (nlnet_labs). https://vulnogram.org/seaview/icons/nlnet_labs.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-101341 https://vulnogram.org/CVE-2026-101341 Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is… High Wed, 14 Oct 2026 10:56:51 GMT https://vulnogram.org/CVE-2026-101339 https://vulnogram.org/CVE-2026-101339 A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such… High Wed, 14 Oct 2026 10:56:37 GMT https://vulnogram.org/CVE-2026-101338 https://vulnogram.org/CVE-2026-101338 When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written o… High Wed, 14 Oct 2026 10:56:28 GMT https://vulnogram.org/CVE-2026-101337 https://vulnogram.org/CVE-2026-101337 When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD i… High Wed, 14 Oct 2026 10:56:15 GMT https://vulnogram.org/CVE-2026-85501 https://vulnogram.org/CVE-2026-85501 Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Lab… Medium Wed, 16 Sep 2026 08:32:25 GMT https://vulnogram.org/CVE-2026-82720 https://vulnogram.org/CVE-2026-82720 NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH st… Medium Wed, 16 Sep 2026 08:32:10 GMT https://vulnogram.org/CVE-2026-82717 https://vulnogram.org/CVE-2026-82717 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synth… High Wed, 16 Sep 2026 08:31:59 GMT https://vulnogram.org/CVE-2026-81642 https://vulnogram.org/CVE-2026-81642 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its… Critical Wed, 16 Sep 2026 08:30:58 GMT https://vulnogram.org/CVE-2026-81634 https://vulnogram.org/CVE-2026-81634 In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer le… High Wed, 16 Sep 2026 08:30:15 GMT https://vulnogram.org/CVE-2026-80225 https://vulnogram.org/CVE-2026-80225 In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncache… Medium Wed, 16 Sep 2026 08:30:04 GMT https://vulnogram.org/CVE-2026-78227 https://vulnogram.org/CVE-2026-78227 NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffe… Medium Wed, 16 Sep 2026 08:29:52 GMT https://vulnogram.org/CVE-2026-77955 https://vulnogram.org/CVE-2026-77955 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or… Medium Wed, 16 Sep 2026 08:29:39 GMT https://vulnogram.org/CVE-2026-77860 https://vulnogram.org/CVE-2026-77860 In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for… Low Wed, 16 Sep 2026 08:29:23 GMT https://vulnogram.org/CVE-2026-19538 https://vulnogram.org/CVE-2026-19538 The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open. High Wed, 26 Aug 2026 08:47:08 GMT https://vulnogram.org/CVE-2026-19401 https://vulnogram.org/CVE-2026-19401 Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs,… High Wed, 26 Aug 2026 08:44:08 GMT https://vulnogram.org/CVE-2026-18916 https://vulnogram.org/CVE-2026-18916 Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance. Medium Wed, 26 Aug 2026 08:39:12 GMT https://vulnogram.org/CVE-2026-18664 https://vulnogram.org/CVE-2026-18664 When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied a… High Wed, 26 Aug 2026 08:34:22 GMT https://vulnogram.org/CVE-2026-56444 https://vulnogram.org/CVE-2026-56444 In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve exp… Medium Wed, 22 Jul 2026 13:10:34 GMT https://vulnogram.org/CVE-2026-56416 https://vulnogram.org/CVE-2026-56416 In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, .… Medium Wed, 22 Jul 2026 13:10:24 GMT https://vulnogram.org/CVE-2026-55991 https://vulnogram.org/CVE-2026-55991 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one… Medium Wed, 22 Jul 2026 13:10:13 GMT https://vulnogram.org/CVE-2026-55990 https://vulnogram.org/CVE-2026-55990 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at th… Medium Wed, 22 Jul 2026 13:10:01 GMT https://vulnogram.org/CVE-2026-55973 https://vulnogram.org/CVE-2026-55973 In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a d… High Wed, 22 Jul 2026 13:09:50 GMT https://vulnogram.org/CVE-2026-55717 https://vulnogram.org/CVE-2026-55717 In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who c… Medium Wed, 22 Jul 2026 13:09:40 GMT https://vulnogram.org/CVE-2026-55708 https://vulnogram.org/CVE-2026-55708 In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to b… Low Wed, 22 Jul 2026 13:09:30 GMT https://vulnogram.org/CVE-2026-54478 https://vulnogram.org/CVE-2026-54478 In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared… Low Wed, 22 Jul 2026 13:09:18 GMT https://vulnogram.org/CVE-2026-52863 https://vulnogram.org/CVE-2026-52863 In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is… Medium Wed, 22 Jul 2026 13:09:06 GMT https://vulnogram.org/CVE-2026-50252 https://vulnogram.org/CVE-2026-50252 In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their… Medium Wed, 22 Jul 2026 13:08:54 GMT https://vulnogram.org/CVE-2026-50251 https://vulnogram.org/CVE-2026-50251 In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS… Medium Wed, 22 Jul 2026 13:08:43 GMT https://vulnogram.org/CVE-2026-50248 https://vulnogram.org/CVE-2026-50248 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA r… Medium Wed, 22 Jul 2026 13:08:32 GMT https://vulnogram.org/CVE-2026-50243 https://vulnogram.org/CVE-2026-50243 In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not ch… Medium Wed, 22 Jul 2026 13:08:21 GMT https://vulnogram.org/CVE-2026-50046 https://vulnogram.org/CVE-2026-50046 In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct… Medium Wed, 22 Jul 2026 13:08:08 GMT https://vulnogram.org/CVE-2026-50045 https://vulnogram.org/CVE-2026-50045 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effecti… Medium Wed, 22 Jul 2026 13:07:55 GMT https://vulnogram.org/CVE-2026-46582 https://vulnogram.org/CVE-2026-46582 In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bo… Low Wed, 22 Jul 2026 13:07:40 GMT https://vulnogram.org/CVE-2026-44690 https://vulnogram.org/CVE-2026-44690 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controll… High Wed, 22 Jul 2026 13:06:56 GMT https://vulnogram.org/CVE-2026-44687 https://vulnogram.org/CVE-2026-44687 In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caus… Low Wed, 22 Jul 2026 13:06:42 GMT https://vulnogram.org/CVE-2026-44621 https://vulnogram.org/CVE-2026-44621 With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_allo… Medium Wed, 22 Jul 2026 13:06:28 GMT https://vulnogram.org/CVE-2026-42955 https://vulnogram.org/CVE-2026-42955 In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured va… Low Wed, 22 Jul 2026 13:05:53 GMT https://vulnogram.org/CVE-2026-41637 https://vulnogram.org/CVE-2026-41637 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. Th… Low Wed, 22 Jul 2026 13:04:52 GMT https://vulnogram.org/CVE-2026-40691 https://vulnogram.org/CVE-2026-40691 In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is no… High Wed, 22 Jul 2026 13:04:35 GMT https://vulnogram.org/CVE-2026-32665 https://vulnogram.org/CVE-2026-32665 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input… High Wed, 22 Jul 2026 13:04:18 GMT https://vulnogram.org/CVE-2026-14586 https://vulnogram.org/CVE-2026-14586 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of s… Medium Wed, 22 Jul 2026 13:03:53 GMT https://vulnogram.org/CVE-2026-12490 https://vulnogram.org/CVE-2026-12490 When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the… High Thu, 25 Jun 2026 05:24:41 GMT https://vulnogram.org/CVE-2026-12246 https://vulnogram.org/CVE-2026-12246 NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes. High Thu, 25 Jun 2026 05:24:29 GMT https://vulnogram.org/CVE-2026-12245 https://vulnogram.org/CVE-2026-12245 NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without readi… High Thu, 25 Jun 2026 05:24:18 GMT https://vulnogram.org/CVE-2026-12244 https://vulnogram.org/CVE-2026-12244 If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space ne… High Thu, 25 Jun 2026 05:24:08 GMT https://vulnogram.org/CVE-2026-10846 https://vulnogram.org/CVE-2026-10846 NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither th… High Wed, 10 Jun 2026 06:37:59 GMT https://vulnogram.org/CVE-2026-49235 https://vulnogram.org/CVE-2026-49235 When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes. High Mon, 08 Jun 2026 12:59:09 GMT https://vulnogram.org/CVE-2026-49234 https://vulnogram.org/CVE-2026-49234 When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks. High Mon, 08 Jun 2026 12:58:58 GMT https://vulnogram.org/CVE-2026-49233 https://vulnogram.org/CVE-2026-49233 Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker ac… High Mon, 08 Jun 2026 12:58:49 GMT https://vulnogram.org/CVE-2026-49232 https://vulnogram.org/CVE-2026-49232 Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of file descriptors. This condition can be triggered maliciously by an attacker by opening a large number of connect… High Mon, 08 Jun 2026 12:58:37 GMT