hacks

Hacks Hacky one-off scripts, tests etc...

CVE-2019-6467

CVE-2019-6467 BIND nxdomain-redirect For educational purposes only Run $ docker run --rm --name cve-2019-6467 -it -p 53:53/udp knqyf263/cve-2019-6467 Exploit Normal query $ dig @127.0.0.1 nxdomain.example.com nxdomain can be replaced by anything that means non-existent domain name. e.g...

SUSE CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

DEBIAN-CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

AZL-110531 CVE-2026-50106 affecting package unbound 1.26.1-1

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

EUVD-2026-107152

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

CVE-2026-50106 Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

CVE-2026-50106

NLnet Labs Unbound (up to and including version 1.26.1 ) is vulnerable to a logic flaw in its DNS validator when configured with both a root trust anchor and an additional trust-anchor: for an island-of-security zone. If the zone's parent is provably insecure under the root chain, a malicious act...

CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

PT-2026-120507

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.2 Description An issue exists when the software is configured with both a root trust anchor and an additional trust-anchor: for an island-of-security zone whose parent is provably insecure under the ro...

Linux Distros Unpatched Vulnerability : CVE-2026-50106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-securi...

K000163710: BIND vulnerability CVE-2026-10723

Security Advisory Description BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through...

F5 Networks BIG-IP : BIND vulnerability (K000163710)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.6 / 17.5.1.10 / 21.1.0.3. It is, therefore, affected by a vulnerability as referenced in the K000163710 advisory. BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge...

bind: bind9: Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

EulerOS 2.0 SP13 : bind (EulerOS-SA-2026-4122)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue...

EulerOS 2.0 SP13 : bind (EulerOS-SA-2026-4031)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue...

bind: bind9: Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

EulerOS 2.0 SP15 : bind (EulerOS-SA-2026-3965)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is...