19 matches found
CVE-2026-46582
A flaw was found in Unbound, a Domain Name System DNS resolver. A remote attacker can exploit a vulnerability in how Unbound handles expired DNSSEC DNS Security Extensions records. By injecting a replayed wildcard record set, an attacker can cause Unbound to temporarily consider it secure, leadin...
SUSE CVE-2026-44690
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary...
CVE-2026-52686 Wildcard CNAME proof validation bypass
The issue is a DNSSEC validation bypass where wildcard expansion proofs NSEC/NSEC3 records are accepted without signature validation when the wildcard answer is a CNAME or DNAME record...
CVE-2026-44690
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary...
CVE-2026-44690 Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary...
CVE-2026-44690
The CVE-2026-44690 entry concerns NLnet Labs Unbound versions 1.7.0 through 1.25.1 where insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing enables cache poisoning. A malicious actor controlling a single delegated zone...
RHEL 7 : unbound (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - unbound: command injection with data coming from a specially crafted IPSECKEY answer CVE-2019-18934 - A...
SUSE CVE-2017-15107
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist...
SUSE CVE-2017-15105
A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence NXDOMAIN answer of an existing wildcard record, or trick unbound into accepting a NODATA proof...
USN-4924-1 dnsmasq vulnerabilities
It was discovered that Dnsmasq incorrectly handled certain wildcard synthesized NSEC records. A remote attacker could possibly use this issue to prove the non-existence of hostnames that actually exist. CVE-2017-15107 It was discovered that Dnsmasq incorrectly handled certain large DNS packets. A...
Unbound Security Bypass Vulnerability
Unbound is a C-based open source recursive DNS server software maintained by NLnet Labs in the Netherlands. A security vulnerability exists in Unbound versions prior to 1.6.8, which stems from the program failing to properly validate wildcard records. An attacker could exploit this vulnerability ...
ALPINE-CVE-2017-15107
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist...
DEBIAN-CVE-2017-15107
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist...
UBUNTU-CVE-2017-15107
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist...
DEBIAN-CVE-2017-15105
A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence NXDOMAIN answer of an existing wildcard record, or trick unbound into accepting a NODATA proof...
UBUNTU-CVE-2017-15105
A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence NXDOMAIN answer of an existing wildcard record, or trick unbound into accepting a NODATA proof...
CVE-2017-15107: Improperly Implemented Security Check for Standard
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist...
PT-2018-5765
Name of the Vulnerable Software and Affected Versions: unbound versions prior to 1.6.8 Description: A flaw was found in the way unbound validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence of an existing wildcard record...
dns-brute NSE Script
Attempts to enumerate DNS hostnames by brute force guessing of common subdomains. With the dns-brute.srv argument, dns-brute will also try to enumerate common DNS SRV records. Wildcard records are listed as "A" and "AAAA" for IPv4 and IPv6 respectively. See also: dns-nsec3-enum.nse...