Linux Distros Unpatched Vulnerability : CVE-2026-93657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid...

Fedora 45 : unbound (2026-3baacede89)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3baacede89 advisory. Update to 1.26.1 rhbz2535076 Security fix list from upstream: - Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code Execution when...

CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

DEBIAN-CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

UBUNTU-CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657 hickory-resolver before 0.26.2 DNSSEC Validation Bypass

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657 hickory-resolver before 0.26.2 DNSSEC Validation Bypass

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

EUVD-2026-82939

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657

hickory-resolver versions before 0.26.2 contain a DNSSEC validation bypass. The root cause is a failure to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, causing invalid records to be returned as successful results. An attacker controlling the a...

CVE-2026-93657 hickory-resolver before 0.26.2 DNSSEC Validation Bypass

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-93657: Improper Verification of Cryptographic Signature

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

PT-2026-95426

Name of the Vulnerable Software and Affected Versions hickory-resolver versions prior to 0.26.2 Description The software fails to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookup ip APIs, which allows invalid records to be returned as successful results. This...

Amazon Linux 2 : unbound (ALASUNBOUND-1.17-2026-010)

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2026-010 advisory. In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial...

Amazon Linux 2 : unbound (ALAS-2026-3928)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3928 advisory. In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service...

ISC BIND 9.11.0 < 9.20.29 / 9.11.3-S1 < 9.20.29-S1 / 9.20.0 < 9.20.29 / 9.20.9-S1 < 9.20.29-S1 / 9.21.0 < 9.21.26 Multiple Vulnerabilities

The version of ISC BIND running on the remote host is 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, or 9.21.0 through 9.21.25. Supported Preview Edition releases 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1 are also affected. It is, therefore, affected by multiple vulnerabiliti...

CVE-2026-81642

A flaw was found in Unbound's DNSSEC validator. A remote attacker can exploit this vulnerability by controlling a malicious zone and sending a specially crafted DNSKEY record. This can lead to a heap buffer overflow, potentially resulting in a denial of service or remote code execution. Mitigatio...

K000163335: BIND vulnerability CVE-2026-11622

Security Advisory Description A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be...

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound...