dnsviz

Table of Contents Installation Usage Pre-Deployment DNS Testing Docker Container Description DNSViz is a tool suite for analysis and visualization of Domain Name System DNS behavior, including its security extensions DNSSEC. This tool suite powers the Web-based analysis available at...

NSEC3-X

DISCLAIMER: This project was generated by Artificial Intelligence AI but has undergone a rigorous "Human-in-the-Loop" HITL process. This means the code has been reviewed and refactored by a human software engineer, the architectural design was human-directed, and a basic security audit was...

numa

Numa DNS you own. Everywhere you go. — numa.rs A portable DNS resolver in a single binary. Block ads on any network, name your local services frontend.numa, override any hostname with auto-revert, and seal every outbound query with ODoH RFC 9230 so no single party sees both who you are and what y...

vaas-cve-2015-5477

Vulnerability as a Service - CVE 2015-5477 A Debian Wheezy Linux system with a vulnerable version of bind9 to showcase CVS-2015-5477. Overview This docker container is based on Debian Wheezy and has been modified to use a vulernable version of bind9 and the matching additional dependencies. Usage...

CVE-2023-50387

CVE-2023-50387 KeyTrap in DNS CVE-2023-50387 This repository is for educational purposes. The number of keys and signatures has been intentionally kept low to prevent their use in actual attacks, and a script for generating colliding keys are not included. Test Setting up the PoC environment $...

CVE-2023-50387

Repository based on https://github.com/knqyf263/CVE-2023-50387 with several modifications: Added resolver-fixed, which has an implementation of Unbound where the vulnerability we discussed is fixed. Created scripts for automating the generation of RRSIG keys. To auto-generate configuration files:...

NSEC3-Encloser-Attack

NSEC3-Encloser-Attack Zonefile Generation This project generates DNS zonefiles with custom NSEC3 parameters to reproduce and evaluate the attacks in CVE-2023-50868. Requirements Python3 tested on Python3.10 Installed Python dependencies: cryptography 42.0.5 dnspython 2.6.1 Components lib: Python...

CVE-2026-81642

CVE-2026-81642 — Unbound DNSKEY digest heap overflow tracking site Source for the CVE-2026-81642 patch-status tracker: a single-page site recording which distributions have shipped a fix for the Unbound DNSSEC validator heap overflows and the ReTrap complexity attacks disclosed alongside them...

dns-benchmark-tool

⚠️ this project has moved and is no longer maintained. install the successor: pip install net-benchmark repository: https://github.com/net-benchmark/net-benchmark all existing commands and flags remain fully compatible. DNS Benchmark Tool Part of BuildTools - Network Performance Suite Fast,...

SSR-DNSSEC

The DNS infrastructure used for this PoC was the one suggested on the SEED Labs, available at: https://seedsecuritylabs.org/Labs20.04/Networking/DNS/DNSSEC/, with some minor changes. The infrastructure, consists of a root server, a top-level domain server for edu, a domain server for example.edu,...

K000163710: BIND vulnerability CVE-2026-10723

Security Advisory Description BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through...

USN-8929-1: Bind vulnerabilities

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: unbound (UTSA-2026-130094)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130094 advisory. In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Bind vulnerability (USN-8696-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8696-1 advisory. It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one...

SUSE SLES15 Security Update : unbound (SUSE-SU-2026:4624-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4624-1 advisory. - CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' bsc1280403. - CVE-2026-77955: Possible ZONEMD verification bypass...

MiracleLinux 8 : bind-9.11.36-16.el8_10.16 (AXSA:2026-2019:13)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2019:13 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via...

MiracleLinux 8 : bind9.16-9.16.23-0.22.el8_10.16 (AXSA:2026-2034:05)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2034:05 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via...

SUSE-SU-2026:4624-1 Security update for unbound

This update for unbound fixes the following issues: - CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' bsc1280403. - CVE-2026-77955: Possible ZONEMD verification bypass window bsc1280404. - CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission...

Security update for unbound

This update for unbound fixes the following issues: CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' bsc1280403. CVE-2026-77955: Possible ZONEMD verification bypass window bsc1280404. CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission bsc1280405...

SUSE-SU-2026:4620-1 Security update for unbound

This update for unbound fixes the following issues: - CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' bsc1280403. - CVE-2026-77955: Possible ZONEMD verification bypass window bsc1280404. - CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission...