Syborg

Syborg Syborg is a Recursive DNS Domain Enumerator which is neither active nor completely passive. This tool simply constructs a domain name and queries it with a specified DNS Server. Syborg has a Dead-end Avoidance system inspired from @Tomnomnom's ettu. When you run subdomain enumeration with...

SUSE CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

CVE-2026-97313

A recursive BIND server that receives a query with recursion desired RD=1 followed by a non-recursive query RD=0 may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one wit...

CVE-2026-97313 Specific RPZ configurations and query patterns may result in an unexpected exit

A recursive BIND server that receives a query with recursion desired RD=1 followed by a non-recursive query RD=0 may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one wit...

CVE-2026-97313

The BIND 9 recursive DNS server is vulnerable to a denial of service (DoS) condition due to an assertion failure . This occurs when the server receives a query with recursion desired (RD=1 ) followed by a non-recursive query (RD=0 ) under specific RPZ configurations . To be exploitable, the serve...

CVE-2026-97313 Specific RPZ configurations and query patterns may result in an unexpected exit

A recursive BIND server that receives a query with recursion desired RD=1 followed by a non-recursive query RD=0 may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one wit...

AZL-110534 CVE-2026-96405 affecting package unbound for versions less than 1.26.2-1

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

DEBIAN-CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

EUVD-2026-107153

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

CVE-2026-96405 Aggregate DNS name chained pointer decompression work leads to degradation of service.

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

CVE-2026-96405

NLnet Labs Unbound versions up to and including 1.26.1 are vulnerable to a resource exhaustion issue. While the software limits compression-pointer traversal for individual domain-name operations, it lacks an aggregate inbound decompression-work budget . An attacker with recursive-query access an...

CVE-2026-96405 Aggregate DNS name chained pointer decompression work leads to degradation of service.

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

Amazon Linux 2023: CVE-2026-96405: Medium priority package update for unbound

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

Linux Distros Unpatched Vulnerability : CVE-2026-96405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inboun...

PT-2026-134539

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

PT-2026-120515

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.2 Description NLnet Labs Unbound limits compression-pointer traversal for each individual domain-name operation but lacks an aggregate inbound decompression-work budget. A malicious actor with...

PYSEC-2026-3822 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

GHSA-8JJ7-4V57-FRF5 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...