24507 matches found
'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
...
Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
...
Possible cache poisoning attack by mapping source port population per thread
...
Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush
...
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
...
Packet of death for a DNSCrypt misconfigured Unbound
...
Possible heap use-after-free in an error path when a DoT forwarded query is jostled out
...
Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
...
Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records
...
A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path
...
DNS Cookie bypass when combined with proxy-protocol use
...
Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration
...
Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
...
Packet of death for DNSCrypt over TCP
...
'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash
...
Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated
...
Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name
...
Memory corruption could lead to crash and denial of service
...
Privacy/configuration issue when adding local data in views through 'unbound-control'
...
Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
...
BOGUS configured primary hostname accepted for XFR in auth/rpz zones
...
'max-global-quota' reset by DNSSEC validation restarts
...
Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN
...
'dns-error-reporting: yes' leads to stack buffer overflow
...
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
...
i2c: stub: Reject I2C block transfers with invalid length
...
net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
...
netfilter: ipset: fix race between dump and ip_set_list resize
...
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
...
i2c: i801: fix hardware state machine corruption in error path
...
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
...
xfs: fail recovery on a committed log item with no regions
...
Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero
...
Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c
...
FFC-DH Peer Validation Uses Attacker-Supplied q
...
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
...
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
...
virtiofs: fix UAF on submount umount
...
apparmor: fix use-after-free in rawdata dedup loop
...
NFSD: Fix SECINFO_NO_NAME decode error cleanup
...
9p: avoid putting oldfid in p9_client_walk() error path
...
media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
...
apparmor: mediate the implicit connect of TCP fast open sendmsg
...
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
...
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
...
blk-cgroup: fix UAF in __blkcg_rstat_flush()
...
mac802154: llsec: add skb_cow_data() before in-place crypto
...
ocfs2: reject oversized group bitmap descriptors
...