CVE-2026-42396

Technical details for CVE-2026-42396 are not publicly available in the provided documents. Monitor for updates from Debian advisories and NVD for affected versions and fixes.

CVE-2026-42396

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail...

CVE-2026-42396 Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail...

CVE-2026-42396

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail...

CVE-2026-42396 Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail...

CVE-2026-42396 Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail...

EUVD-2026-31265

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail...

CVE-2026-44608

A flaw was found in Unbound. When operating in a multi-threaded configuration with specific Response Policy Zones RPZ using 'rpz-nsip' or 'rpz-nsdname' triggers, a locking inconsistency during an RPZ zone transfer XFR reload can occur. This timing issue may allow an adversary to trigger a heap...

PT-2026-42446

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Insufficient validation of names occurs during AXFR Asynchronous Full Transfer, a mechanism used by DNS servers to replicate zone data from a primary server to a...

PT-2026-42449

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Insufficient validation of member zone data may cause the catalog zone transfer to fail. Recommendations At the moment, there is no information about a newer...

PowerDNS Authoritative 命令注入漏洞

PowerDNS Authoritative is a DNS server software developed by PowerDNS Corporation. PowerDNS Authoritative has a command injection vulnerability, which stems from insufficient name validation during the AXFR process...

CVE-2026-44608 Use after free and crash under special conditions in RPZ code

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers it could result in heap use-after-free and eventual crash. An adversary can...

CVE-2026-44608 Use after free and crash under special conditions in RPZ code

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers it could result in heap use-after-free and eventual crash. An adversary can...

CVE-2026-44608

Summary: NLnet Labs Unbound versions 1.14.0–1.25.0 contain a locking inconsistency in RPZ handling that can cause a heap use-after-free and crash under specific multi-threaded conditions when an RPZ XFR reload occurs and an RPZ zone is loaded with rpz-nsip or rpz-nsdname triggers. An attacker wou...

CVE-2026-44608

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers it could result in heap use-after-free and eventual crash. An adversary can...

PowerDNS -- Multiple vulnerabilities

PowerDNS Team reports: 2025-07: Internal logic flaw in cache management can lead to a denial of service in Recursor When using views, queries sent using TCP Proxy Protocol will select the view according to the address of the proxy, rather than the address of the initial query. This can lead to...

Unity Linux 20.1060e / 20.1070e Security Update: bind (UTSA-2026-017660)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017660 advisory. In BIND 9.8.5 - 9.8.8, 9.9.3 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of BIND 9 Supported Preview Edition, as...

SUSE CVE-2026-33489

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch function in plugin/transfer/transfer.go uses a lexicographic string comparison instead...

CVE-2026-33489

CoreDNS CVE-2026-33489 affects the transfer plugin prior to version 1.14.3. The root cause is a lexicographic longestMatch() comparison in plugin/transfer/transfer.go, which can select a permissive parent-zone ACL over a more-specific subzone ACL when both are configured. This flaw enables an una...

CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch function in plugin/transfer/transfer.go uses a lexicographic string comparison instead...