CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

EUVD-2026-47662

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for...

CVE-2026-14586

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for...

EUVD-2026-47661

A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation...

CVE-2026-16560

A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation...

CVE-2026-16560

A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation. Mitigation Deni...

glibc security update

An update is available for glibc. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The glibc packages provide the standard C libraries libc, POSIX thread librari...

glibc: glibc: Application crash or uninitialized memory read via crafted DNS response

A flaw was found in glibc GNU C Library. The deprecated functions nsprintrrf, nsprintrr, and fpnquery do not properly validate the length of RDATA Resource Record Data in a DNS Domain Name System response when processing specific record types like LOC, CERT, TKEY, or TSIG. A remote attacker could...

[SECURITY] Fedora 43 Update: nuclei-3.11.0-1.fc43

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaborati on to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud...

CVE-2026-64028

A flaw was found in the Linux kernel's tracing subsystem. The histfieldname function, responsible for handling field names, can return a NULL value if a long variable name in a fully-qualified reference causes snprintf truncation. This unexpected NULL return can lead to a NULL pointer dereference...

PT-2026-63414

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.16.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.16.8-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description An attacker can craft...

PT-2026-63380

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.15.0 through 1.25.1 Description A use-after-free issue exists in the handling of DNS-over-TLS DoT forwarded queries. The TLS server name is tied to the lifetime of the serviced query struct but is also referenced ...

PT-2026-63416

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description A DNSSEC validating...

PT-2026-63420

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description The BIND resolver accept...

PT-2026-63392

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.2 Description A heap buffer overflow occurs when the validator builds the canonical RDATA form for an RRSIG-covered PX, RP, MINFO, or SOA RRset. The system computes the address of the second embedded...

samba security update

4.10.16-25.0.11 - Fix CVE-2026-4408 and CVE-2026-4480 Orabug: 39599120 4.10.16-25.0.9 - s3:winbindd: avoid using any netlogon call to get a dc name Orabug: 38560263 - winbindd: use finddomainfromnamenoinit in finddnsdomainname Orabug: 38560263 4.10.16-25.0.7 - Fixed winbind dsgetdcname calls w.r....

PT-2026-63376

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.13.2 through 1.25.1 Description An off-by-one error exists in the harden-below-nxdomain logic, which is enabled by default. This issue occurs when stub or forward zones are located below an intermediate label that...

AlmaLinux 10 : glibc (ALSA-2026:42694)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42694 advisory. glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings CVE-2026-5928 glibc: glibc:...

RHEL 9 : glibc (RHSA-2026:42952)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42952 advisory. The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name...

RHEL 7 : gnutls (RHSA-2026:43575)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:43575 advisory. The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such a...