NLnet Labs vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-72758 When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximuHigh 7.5 · Oct 26, 2026
• CVE-2026-72756 Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names thHigh 7.5 · Oct 26, 2026
• CVE-2026-72754 When Routinator encounters a CRL with many entries, it may hang or run out of memory.High 7.5 · Oct 26, 2026
• CVE-2026-72753 When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data.High 8.2 · Oct 26, 2026
• CVE-2026-97206 NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threadedHigh 7.5 · Oct 21, 2026
• CVE-2026-101341 Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sizedHigh 8.7 · Oct 14, 2026
• CVE-2026-101339 A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 1High 8.7 · Oct 14, 2026
• CVE-2026-101338 When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 deHigh 8.7 · Oct 14, 2026
• CVE-2026-101337 When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes.High 8.7 · Oct 14, 2026
• CVE-2026-82717 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilatHigh 8.4 · Sep 16, 2026
• CVE-2026-81642 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execCritical 9.1 · Sep 16, 2026
• CVE-2026-81634 In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicaHigh 7.5 · Sep 16, 2026
• CVE-2026-19538 The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLHigh 8.2 · Aug 26, 2026
• CVE-2026-19401 Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS CoHigh 8.2 · Aug 26, 2026
• CVE-2026-18664 When ranges are used for access control (i.e.High 8.2 · Aug 26, 2026
• CVE-2026-55973 In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstreamHigh 7.5 · Jul 22, 2026
• CVE-2026-44690 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aHigh 7.5 · Jul 22, 2026
• CVE-2026-40691 In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply lHigh 7.5 · Jul 22, 2026
• CVE-2026-32665 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC conneHigh 7.5 · Jul 22, 2026
• CVE-2026-12490 When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name.High 8.2 · Jun 25, 2026
• CVE-2026-12246 NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack whHigh 7.2 · Jun 25, 2026
• CVE-2026-12245 NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered triviaHigh 8.7 · Jun 25, 2026
• CVE-2026-12244 If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with aHigh 8.7 · Jun 25, 2026
• CVE-2026-10846 NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address anHigh 8.2 · Jun 10, 2026
• CVE-2026-49235 When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.High 8.7 · Jun 8, 2026