NSEC3-Encloser-Attack

NSEC3-Encloser-Attack Zonefile Generation This project generates DNS zonefiles with custom NSEC3 parameters to reproduce and evaluate the attacks in CVE-2023-50868. Requirements Python3 tested on Python3.10 Installed Python dependencies: cryptography 42.0.5 dnspython 2.6.1 Components lib: Python...

NSEC3-X

DISCLAIMER: This project was generated by Artificial Intelligence AI but has undergone a rigorous "Human-in-the-Loop" HITL process. This means the code has been reviewed and refactored by a human software engineer, the architectural design was human-directed, and a basic security audit was...

RLSA-2026:97121 Moderate: unbound security, bug fix, and enhancement update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance CVE-2026-42960 unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cach...

unbound security, bug fix, and enhancement update

An update is available for unbound. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unbound packages provide a validating, recursive, and caching DNS or...

unbound security, bug fix, and enhancement update

An update is available for unbound. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unbound packages provide a validating, recursive, and caching DNS or DNSS...

RLSA-2026:97497 Moderate: unbound security, bug fix, and enhancement update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance CVE-2026-42960 unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cach...

dnsmasq: NSEC bitmap parsing infinite loop

A denial of service vulnerability was discovered in dnsmasq's DNSSEC validation. When parsing NSEC and NSEC3 bitmap records, the window iteration logic fails to account for the 2-byte window header when advancing through the bitmap data. A specially crafted DNS response with a zero-length bitmap...

unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cache Code Path Leading to DoS

A flaw was found in Unbound's DNSSEC validator where the code path for consulting the negative cache for DS records does not honor the limit on NSEC3 hash calculations introduced in version 1.19.1. An adversary who controls a DNSSEC-signed zone can sign NSEC3 records with high iteration counts fo...

Moderate: Red Hat Security Advisory: unbound security, bug fix, and enhancement update

An update for unbound is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cache Code Path Leading to DoS

A flaw was found in Unbound's DNSSEC validator where the code path for consulting the negative cache for DS records does not honor the limit on NSEC3 hash calculations introduced in version 1.19.1. An adversary who controls a DNSSEC-signed zone can sign NSEC3 records with high iteration counts fo...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching bsc1280436. CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets bsc1280440. Patch Instructions: To install this SUSE update use...

RHEL 9 : unbound (RHSA-2026:97497)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:97497 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound DNS Cache...

RHEL 10 : unbound (RHSA-2026:97121)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:97121 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound DNS Cache...

dnsmasq: NSEC bitmap parsing infinite loop

A denial of service vulnerability was discovered in dnsmasq's DNSSEC validation. When parsing NSEC and NSEC3 bitmap records, the window iteration logic fails to account for the 2-byte window header when advancing through the bitmap data. A specially crafted DNS response with a zero-length bitmap...

dnsmasq: NSEC bitmap parsing infinite loop

A denial of service vulnerability was discovered in dnsmasq's DNSSEC validation. When parsing NSEC and NSEC3 bitmap records, the window iteration logic fails to account for the 2-byte window header when advancing through the bitmap data. A specially crafted DNS response with a zero-length bitmap...

CVE-2026-123601

Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of findcoveringrecord in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to...

Linux Distros Unpatched Vulnerability : CVE-2026-123595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's...

Linux Distros Unpatched Vulnerability : CVE-2026-123600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that...

Linux Distros Unpatched Vulnerability : CVE-2026-123580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC...

Linux Distros Unpatched Vulnerability : CVE-2026-123591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 fail to verify, per RFC 6840 4.4, that an NSEC or NSEC3 record...