knot-doq

Knot Resolver 6.3.0 — DNS-over-QUIC heap overflow → RCE PoC Proof-of-concept for a remotely triggerable heap buffer overflow in Knot Resolver's DNS-over-QUIC DoQ receive path that yields remote code execution as the knot-resolver service user. Component: kresd DoQ listener daemon/quicconn.c...

SUSE CVE-2026-97206

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

[SECURITY] [DSA 6581-1] unbound security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6581-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez October 23, 2026 https://www.debian.org/security/faq -...

Debian dsa-6581 : libunbound-dev - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6581 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6581-1 [email protected] https://www.debian.org/securit...

USN-8946-1 unbound vulnerabilities

It was discovered that Unbound incorrectly handled certain TCP connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS...

AZL-109824 CVE-2026-97206 affecting package unbound 1.26.1-1

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

DEBIAN-CVE-2026-97206

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

CVE-2026-97206

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

EUVD-2026-107154

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

CVE-2026-97206 DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

CVE-2026-97206

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

CVE-2026-97206

NLnet Labs Unbound versions 1.22.0 up to and including 1.26.1 are vulnerable to a DNS-over-QUIC (DoQ) lifetime bug . Under multi-threaded operation, a client-triggered QUIC path migration can trigger stream/connection cleanup while a mesh reply still holds a pointer to the DoQ stream. This result...

PT-2026-120516

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.26.1 Description A lifetime bug exists in DNS-over-QUIC DoQ when operating in multi-threaded mode. A remote DoQ client can trigger a QUIC path migration, causing the system to enter stream or...

Linux Distros Unpatched Vulnerability : CVE-2026-97206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded...

NLnet Labs Unbound Resource Management Vulnerability

NLnet Labs’ Unbound versions from 1.22.0 to 1.26.1 have a resource management vulnerability. This vulnerability stems from a DNS-over-QUIC DoQ lifecycle flaw. In a multi-threaded environment, remote DoQ clients can trigger QUIC path migration. This allows stream or connection cleanup to occur whi...

OESA-2026-4197 coredns security update

CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and...

OESA-2026-4196 coredns security update

CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and...

OESA-2026-4195 coredns security update

CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and...

OESA-2026-4194 coredns security update

CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and...

SUSE CVE-2026-78227

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffe...