CVE-2023-50387

CVE-2023-50387 KeyTrap in DNS CVE-2023-50387 This repository is for educational purposes. The number of keys and signatures has been intentionally kept low to prevent their use in actual attacks, and a script for generating colliding keys are not included. Test Setting up the PoC environment $...

numa

Numa DNS you own. Everywhere you go. — numa.rs A portable DNS resolver in a single binary. Block ads on any network, name your local services frontend.numa, override any hostname with auto-revert, and seal every outbound query with ODoH RFC 9230 so no single party sees both who you are and what y...

dnsviz

Table of Contents Installation Usage Pre-Deployment DNS Testing Docker Container Description DNSViz is a tool suite for analysis and visualization of Domain Name System DNS behavior, including its security extensions DNSSEC. This tool suite powers the Web-based analysis available at...

vaas-cve-2015-5477

Vulnerability as a Service - CVE 2015-5477 A Debian Wheezy Linux system with a vulnerable version of bind9 to showcase CVS-2015-5477. Overview This docker container is based on Debian Wheezy and has been modified to use a vulernable version of bind9 and the matching additional dependencies. Usage...

CVE-2023-50387

Repository based on https://github.com/knqyf263/CVE-2023-50387 with several modifications: Added resolver-fixed, which has an implementation of Unbound where the vulnerability we discussed is fixed. Created scripts for automating the generation of RRSIG keys. To auto-generate configuration files:...

NSEC3-Encloser-Attack

NSEC3-Encloser-Attack Zonefile Generation This project generates DNS zonefiles with custom NSEC3 parameters to reproduce and evaluate the attacks in CVE-2023-50868. Requirements Python3 tested on Python3.10 Installed Python dependencies: cryptography 42.0.5 dnspython 2.6.1 Components lib: Python...

RLSA-2026:79113 Important: bind9.16 security, bug fix, and enhancement update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

bind9.16 security, bug fix, and enhancement update

An update is available for bind9.16. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Berkeley Internet Name Domain BIND is an implementation of the Domain Na...

RLSA-2026:79162 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

bind security update

An update is available for bind. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Berkeley Internet Name Domain BIND is an implementation of the Domain Name...

CVE-2026-81642

CVE-2026-81642 — Unbound DNSKEY digest heap overflow tracking site Source for the CVE-2026-81642 patch-status tracker: a single-page site recording which distributions have shipped a fix for the Unbound DNSSEC validator heap overflows and the ReTrap complexity attacks disclosed alongside them...

dns-benchmark-tool

⚠️ this project has moved and is no longer maintained. install the successor: pip install net-benchmark repository: https://github.com/net-benchmark/net-benchmark all existing commands and flags remain fully compatible. DNS Benchmark Tool Part of BuildTools - Network Performance Suite Fast,...

NSEC3-X

DISCLAIMER: This project was generated by Artificial Intelligence AI but has undergone a rigorous "Human-in-the-Loop" HITL process. This means the code has been reviewed and refactored by a human software engineer, the architectural design was human-directed, and a basic security audit was...

RHEL 8 : bind (RHSA-2026:79162)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79162 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

Oracle Linux 8 : bind9.16 (ELSA-2026-79113)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-79113 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3...

AlmaLinux 8 : bind (ALSA-2026:79162)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:79162 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via craft...

AlmaLinux 8 : bind9.16 (ALSA-2026:79113)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:79113 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via craft...

SSR-DNSSEC

The DNS infrastructure used for this PoC was the one suggested on the SEED Labs, available at: https://seedsecuritylabs.org/Labs20.04/Networking/DNS/DNSSEC/, with some minor changes. The infrastructure, consists of a root server, a top-level domain server for edu, a domain server for example.edu,...

Important: Red Hat Security Advisory: bind security update

An update for bind is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

bind: BIND: Denial of Service via crafted DNSSEC reply

A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service DoS for the affected BIND resolver...