io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing

A flaw was found in the BIND resolver. A remote attacker could exploit a vulnerability in the processing of SVCB/HTTPS AliasMode records that reference numerous ServiceMode records. This could lead to the resolver failing to properly release internal resources, causing resource exhaustion. Repeat...

bind: BIND: Denial of Service via crafted DNSSEC reply

A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service DoS for the affected BIND resolver...

bind: BIND: Denial of Service via crafted DNSSEC reply

A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service DoS for the affected BIND resolver...

bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing

A flaw was found in the BIND resolver. A remote attacker could exploit a vulnerability in the processing of SVCB/HTTPS AliasMode records that reference numerous ServiceMode records. This could lead to the resolver failing to properly release internal resources, causing resource exhaustion. Repeat...

[SECURITY] Fedora 43 Update: unbound-1.26.1-1.fc43

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection

A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection SSTI vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote attacker could exploit this by embedding malicious template...

NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

EUVD-2026-90653

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-103259

The n8n application versions before 2.39.6 and 2.40.x before 2.40.1 are vulnerable to a session token leakage in the Dynamic Credentials authorize and revoke endpoints. Attackers who possess resolver registration capability can capture collaborators' session tokens by configuring a fallback resol...

CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CLEANSTART-2026-KR88876 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the cri-tools package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

ROOT-APP-MAVEN-CVE-2026-45674 CVE-2026-45674 in io.netty:netty-resolver-dns - Patched by Root

Root has patched CVE-2026-45674 in the io.netty:netty-resolver-dns package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-47691 CVE-2026-47691 in io.netty:netty-resolver-dns - Patched by Root

Root has patched CVE-2026-47691 in the io.netty:netty-resolver-dns package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-45673 CVE-2026-45673 in io.netty:netty-resolver-dns - Patched by Root

Root has patched CVE-2026-45673 in the io.netty:netty-resolver-dns package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-XI18569 c-ares is an asynchronous resolver library

Security vulnerability affects the c-ares package. c-ares is an asynchronous resolver library...

CLEANSTART-2025-JX38595 c-ares is an asynchronous resolver library

Security vulnerability affects the c-ares package. c-ares is an asynchronous resolver library...

CLEANSTART-2026-DN56555 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

CVE-2026-33811 affects multiple packages. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. See references for individual vulnerability details...