CVE-2026-41637

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

CVE-2026-41637

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

CVE-2026-50251 Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...

CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

CVE-2026-41637

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

CVE-2026-41637

CVE-2026-41637 affects NLnet Labs Unbound (versions 1.22.0 to 1.25.1). The vulnerability arises when client-terminated DNS-over-QUIC (DoQ) queries are not counted properly, allowing a low-cost inflation of the waiting queue for in-flight queries and causing degradation of resolution service for n...

CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

CVE-2026-40691

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger th...

CVE-2026-40691

In Unbound, versions 1.9.0 through 1.25.1 are affected when handling DNSCrypt queries over TCP. The routine that encrypts the reply in place does not bound the reply length to the destination buffer, because the UDP path’s size clamp is not applied on the TCP path. As a result, a reply larger tha...

PT-2026-63418

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.18.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.18.11-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description Unexpected program termination occurs in named due to the...

CVE-2026-63932

A flaw was found in the Linux kernel's mhz19b driver, which handles Winsen MHZ19B CO2 sensors. The mhz19breceivebuf function does not properly validate the size of incoming serial replies before copying them into a fixed-size buffer. A remote attacker could exploit this by sending an oversized...

SUSE CVE-2026-63932

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

PT-2026-61925

Name of the Vulnerable Software and Affected Versions rpcbind affected versions not specified Description A stack-based buffer overflow exists in the rpcinfo utility. When operating in short mode via the rpcinfo -s command, the rpcbdump function writes version numbers from a remote RPCBPROC DUMP...

Linux Distros Unpatched Vulnerability : CVE-2026-63996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen...

CVE-2026-63996

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

CVE-2026-63932

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

CVE-2026-64090

CVE-2026-64090 affects the Linux kernel’s batman-adv translation table (TT) handling. The issue arises when a TT reply can be generated either directly or via the global TT state, leading to potential inconsistency and the sending of empty VLANs, which can trigger TT request storms and network in...

CVE-2026-63932 iio: chemical: mhz19b: reject oversized serial replies

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

CVE-2026-63932

In the Linux kernel IIO chemical mhz19b driver, mhz19b_receive_buf() appends serdev chunks into a fixed MHZ19B_CMD_SIZE buffer and advances buf_idx without ensuring fit, enabling a potential overflow of st->buf from a large callback. The patch resets the reply state before each command and rej...

EUVD-2026-45705

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....