NLnet Labs

Latest CVEs · RSS

• CVE-2026-101341 2026-10-14 · CVSS 8.7
  Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized
• CVE-2026-101339 2026-10-14 · CVSS 8.7
  A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 1
• CVE-2026-101338 2026-10-14 · CVSS 8.7
  When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 de
• CVE-2026-101337 2026-10-14 · CVSS 8.7
  When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the s
• CVE-2026-85501 2026-09-16 · CVSS 5.3
  Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service wh
• CVE-2026-82720 2026-09-16 · CVSS 5.9
  NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. Durin
• CVE-2026-82717 2026-09-16 · CVSS 8.4
  In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilat
• CVE-2026-81642 2026-09-16 · CVSS 9.1
  In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code exec
• CVE-2026-81634 2026-09-16 · CVSS 7.5
  In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonica
• CVE-2026-80225 2026-09-16 · CVSS 5.3
  In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on c
• CVE-2026-78227 2026-09-16 · CVSS 6.5
  NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each D
• CVE-2026-77955 2026-09-16 · CVSS 4.4
  In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a t
• CVE-2026-77860 2026-09-16 · CVSS 3.7
  In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counte
• CVE-2026-19538 2026-08-26 · CVSS 8.2
  The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TL
• CVE-2026-19401 2026-08-26 · CVSS 8.2
  Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Co
• CVE-2026-18916 2026-08-26 · CVSS 6.9
  Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote cli
• CVE-2026-18664 2026-08-26 · CVSS 8.2
  When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems
• CVE-2026-56444 2026-07-22 · CVSS 5.9
  In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeou
• CVE-2026-56416 2026-07-22 · CVSS 4.8
  In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it comp
• CVE-2026-55991 2026-07-22 · CVSS 5.9
  In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and
• CVE-2026-55990 2026-07-22 · CVSS 5.9
  In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt
• CVE-2026-55973 2026-07-22 · CVSS 7.5
  In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream
• CVE-2026-55717 2026-07-22 · CVSS 5.9
  In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net
• CVE-2026-55708 2026-07-22 · CVSS 3.1
  In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tre
• CVE-2026-54478 2026-07-22 · CVSS 3.7
  In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 serve