63 matches found
EUVD-2026-119344
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional...
CVE-2026-123585
The hickory-resolver component in Hickory DNS versions 0.25.0 before 0.26.2 is vulnerable to a query amplification attack. The root cause is that the resolver follows irrelevant CNAME records during recursive query resolution, such as those included in the authority or additional sections or thos...
CVE-2026-123585 Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional...
PT-2026-139866
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional...
CVE-2026-123585: hickory-dns: The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving…
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional...
subjack
subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...
TakeOver-v1
TakeOver-v1 What is Subdomain Takeover? Subdomain Takeover is a type of vulnerability that arises when a subdomain points to an external service that has been deleted or is no longer in use. Common examples of these external services include Github, Heroku, Gitlab, and Tumblr. In this scenario, a...
DNSmasq input validation error vulnerability
dnsmasq has an input validation error vulnerability. This vulnerability arises because the parser fails to verify whether CNAME target records in DNS responses belong to the authorized zone of the responding server when processing CNAME records. As a result, attackers can inject cache entries wit...
RHLW-2026-70779BC964A31A7E Lightwell Security Advisory: netty-resolver-dns 4.1.100.Final-rhlw-00001
Red Hat Lightwell has released io.netty:netty-resolver-dns 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-45673, CVE-2026-45674, and CVE-2026-47691. CVE-2026-45673: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port CVE-2026-45674: Netty Vulnerable to D...
netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation
A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin bailiwick of CNAME records in DNS...
GHSA-6F2X-V7Q7-M7M5 hickory-resolver follows irrelevant CNAME records
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records...
hickory-resolver follows irrelevant CNAME records
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records...
PT-2026-115370
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records...
netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation
A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin bailiwick of CNAME records in DNS...
CVE-2026-52686
A flaw was found in pdns-recursor. This vulnerability allows a remote attacker to bypass DNSSEC Domain Name System Security Extensions validation. The flaw occurs because the system accepts wildcard expansion proofs NSEC/NSEC3 records without proper signature validation when the wildcard answer i...
CVE-2026-52686 Wildcard CNAME proof validation bypass
The issue is a DNSSEC validation bypass where wildcard expansion proofs NSEC/NSEC3 records are accepted without signature validation when the wildcard answer is a CNAME or DNAME record...
netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation
A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin bailiwick of CNAME records in DNS...
CVE-2026-45674
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin bailiwick of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue...
CVE-2026-45674 Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin bailiwick of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue...
CVE-2026-45674: Insufficient Verification of Data Authenticity
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin bailiwick of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue...