CLEANSTART-2026-CL63424 In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver

Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver...

PT-2026-108289

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.217.0 through 0.326.0 Description In the PermissionExtension.resolve function on a synchronous field resolver, the result of has permission is evaluated for truthiness. If a custom permission defines has permissio...

CVE-2026-107728: Incorrect Authorization

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve on a synchronous field resolver evaluates the result of haspermission for truthiness. When a custom permission declares haspermission as a normal function but returns an awaitable,...

PT-2026-108706

Name of the Vulnerable Software and Affected Versions svg-sanitizer versions prior to 1.0.0 Description An issue exists where the Resolver::processReferences function in src/ElementReference/Resolver.php builds the SVG reference graph using a case-sensitive predicate for the href attribute. Becau...

CVE-2026-78243

Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record...

EUVD-2026-94255

Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record...

PT-2026-107465

Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record...

CVE-2026-78243: Uncaught Exception

Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record...

RLSA-2026:75577 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

CLEANSTART-2026-TG48757 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the temporal-server package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

GHSA-6F2X-V7Q7-M7M5 hickory-resolver follows irrelevant CNAME records

When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records...

hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

When the hickory-resolver name server pool implementation receives an upstream response with the TC truncated header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no...

GHSA-6W6G-HM98-MHGM hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

When the hickory-resolver name server pool implementation receives an upstream response with the TC truncated header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no...

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup or Resolver::lookupip on a resolver with DNSSEC validation enabled, both methods return Ok... if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSS...

GHSA-5J98-2G5X-46V6 hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

When calling Resolver::lookup or Resolver::lookupip on a resolver with DNSSEC validation enabled, both methods return Ok... if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSS...

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Summary NodeVM's require.external option lets sandboxed code require local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes nodemodules, two defaults combine to fully defeat the sandbox: - require.root defaults to unrestricted...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing

A flaw was found in the BIND resolver. A remote attacker could exploit a vulnerability in the processing of SVCB/HTTPS AliasMode records that reference numerous ServiceMode records. This could lead to the resolver failing to properly release internal resources, causing resource exhaustion. Repeat...