CVE-2026-97206 | High | 7.5 | 2026-10-21 | NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threade… |
CVE-2026-96405 | Medium | 5.3 | 2026-10-21 | NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbou… |
CVE-2026-50106 | Medium | 6.5 | 2026-10-21 | When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-secur… |
CVE-2026-35501 | Low | 3.7 | 2026-10-21 | When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of… |
CVE-2026-109125 | Medium | 5.3 | 2026-10-21 | In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurat… |
CVE-2026-101341 | | | 2026-10-14 | Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary size… |
CVE-2026-101339 | | | 2026-10-14 | A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to… |
CVE-2026-101338 | | | 2026-10-14 | When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 d… |
CVE-2026-101337 | | | 2026-10-14 | When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the… |
CVE-2026-85501 | Medium | 5.3 | 2026-09-16 | Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service w… |
CVE-2026-82720 | Medium | 5.9 | 2026-09-16 | NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. Duri… |
CVE-2026-82717 | Critical | 9.8 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compila… |
CVE-2026-81642 | Critical | 9.8 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code exe… |
CVE-2026-81634 | High | 7.5 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonic… |
CVE-2026-80225 | Medium | 5.3 | 2026-09-16 | In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on… |
CVE-2026-78227 | Medium | 6.5 | 2026-09-16 | NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each… |
CVE-2026-77955 | Medium | 4.4 | 2026-09-16 | In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a… |
CVE-2026-77860 | Low | 3.7 | 2026-09-16 | In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' count… |
CVE-2026-19538 | High | 7.5 | 2026-08-26 | The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or T… |
CVE-2026-19401 | High | 7.5 | 2026-08-26 | Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS C… |
CVE-2026-18916 | High | 7.5 | 2026-08-26 | Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote cl… |
CVE-2026-18664 | Critical | 9.1 | 2026-08-26 | When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian system… |
CVE-2026-56444 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeo… |
CVE-2026-56416 | Medium | 4.8 | 2026-07-22 | In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it com… |
CVE-2026-55991 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and… |
CVE-2026-55990 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscryp… |
CVE-2026-55973 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstrea… |
CVE-2026-55717 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <ne… |
CVE-2026-55708 | Low | 3.1 | 2026-07-22 | In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tr… |
CVE-2026-54478 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 serv… |
CVE-2026-52863 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view na… |
CVE-2026-50252 | Critical | 9.3 | 2026-07-22 | In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DN… |
CVE-2026-50251 | Medium | 5.3 | 2026-07-22 | In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0… |
CVE-2026-50248 | Medium | 6.5 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still cons… |
CVE-2026-50243 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response… |
CVE-2026-50046 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_que… |
CVE-2026-50045 | Medium | 5.3 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send… |
CVE-2026-46582 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based… |
CVE-2026-44690 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198… |
CVE-2026-44687 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could b… |
CVE-2026-44621 | Medium | 5.9 | 2026-07-22 | With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be a… |
CVE-2026-42955 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found… |
CVE-2026-41637 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-c… |
CVE-2026-40691 | High | 7.5 | 2026-07-22 | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply… |
CVE-2026-32665 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC conn… |
CVE-2026-14586 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 abo… |
CVE-2026-12490 | High | 7.5 | 2026-06-25 | When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client cert… |
CVE-2026-12246 | High | 8.1 | 2026-06-25 | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack w… |
CVE-2026-12245 | High | 7.5 | 2026-06-25 | NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivi… |
CVE-2026-12244 | High | 8.8 | 2026-06-25 | If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with… |
CVE-2026-10846 | High | 7.5 | 2026-06-10 | NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address a… |
CVE-2026-49235 | High | 7.5 | 2026-06-08 | When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes. |
CVE-2026-49234 | High | 7.5 | 2026-06-08 | When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes.
This only affects use… |
CVE-2026-49233 | High | 7.5 | 2026-06-08 | Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for… |
CVE-2026-49232 | | | 2026-06-08 | Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of file descriptors. This… |
CVE-2026-44608 | Medium | 5.9 | 2026-05-20 | NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RP… |
CVE-2026-44390 | Medium | 5.3 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compr… |
CVE-2026-42960 | Critical | 10.0 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that com… |
CVE-2026-42959 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious up… |
CVE-2026-42944 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie ED… |
CVE-2026-42923 | Medium | 5.3 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS reco… |
CVE-2026-42534 | Medium | 5.3 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance… |
CVE-2026-41292 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options… |
CVE-2026-40622 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost doma… |
CVE-2026-33278 | Critical | 9.8 | 2026-05-20 | NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote cod… |
CVE-2026-32792 | Medium | 5.3 | 2026-05-20 | NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A… |
CVE-2025-11411 | | | 2025-10-22 | NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS repli… |
CVE-2025-5994 | | | 2025-07-16 | A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound… |
CVE-2025-0638 | High | 7.5 | 2025-01-22 | The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering ill… |
CVE-2024-8508 | Medium | 5.3 | 2024-10-03 | NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compr… |
CVE-2024-1931 | High | 7.5 | 2024-03-07 | NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can l… |
CVE-2024-1622 | High | 7.5 | 2024-02-26 | Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening. |
CVE-2023-39916 | Critical | 9.3 | 2023-09-13 | NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the op… |
CVE-2023-39915 | High | 7.5 | 2023-09-13 | NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input chec… |
CVE-2023-39914 | High | 7.5 | 2023-09-13 | NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This… |
CVE-2023-0158 | High | 7.5 | 2023-01-17 | NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" endpoint. Prior to 0.12.1 a direct query… |
CVE-2022-3204 | High | 7.5 | 2022-09-26 | A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack w… |
CVE-2022-3029 | High | 7.5 | 2022-09-13 | In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base… |
CVE-2022-30699 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting… |
CVE-2022-30698 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting a… |
CVE-2021-43174 | High | 7.5 | 2021-11-09 | NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used… |
CVE-2021-43173 | High | 7.5 | 2021-11-09 | In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to… |
CVE-2021-43172 | High | 7.5 | 2021-11-09 | NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a… |
CVE-2021-41531 | High | 7.5 | 2021-09-21 | NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to… |
CVE-2020-28935 | Medium | 5.5 | 2020-12-07 | NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow f… |
CVE-2017-15105 | Medium | 5.3 | 2018-01-23 | A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to pro… |