EUVD-2026-48763
GHSA-pw7g-jh5j-6w4m
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
Remote unauthenticated network reachability (AV:N/PR:N/UI:N) but heap-overflow weaponization and DoQ-only exposure make it AC:H; full RCE justifies C/I/A:H within the resolver process (S:U).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.
AnalysisAI
Remote code execution in Knot Resolver versions prior to 6.4.1 stems from a heap-based buffer overflow triggered along the DNS-over-QUIC (DoQ) receive path, allowing a remote unauthenticated attacker to corrupt heap memory by sending malformed QUIC-transported DNS traffic to an exposed resolver. Because the flaw lives in the query-receiving code, any Knot Resolver instance that has DoQ listening is reachable over the network without credentials. Publicly available exploit code exists (a dedicated 'knot-doq' proof-of-concept was published), and the issue was disclosed via oss-security; it is not listed in CISA KEV, so there is no confirmation of active exploitation yet.
Technical ContextAI
Knot Resolver is the caching/validating DNS resolver developed by CZ.NIC (CPE vendor 'nic'), commonly built with modern transport support including DNS-over-QUIC (RFC 9250). DoQ layers DNS message framing on top of the QUIC transport, and the parsing/reassembly of QUIC-delivered DNS payloads is where the overflow occurs. The root cause maps to CWE-1284 (Improper Validation of Specified Quantity in Input): a length/count field or buffer-size assumption in the DoQ receive routine is not validated against the actual data, so attacker-controlled input writes past the bounds of a heap allocation, corrupting adjacent heap structures and enabling control-flow hijack characteristic of memory-safety RCE bugs.
RemediationAI
Upgrade to Knot Resolver 6.4.1 or later, which contains the vendor fix (Vendor-released patch: 6.4.1); on Debian and derivatives, apply the distribution's patched package via the security tracker since six releases are affected. If immediate patching is not possible, the most direct compensating control is to disable the DoQ (DNS-over-QUIC) listener or otherwise stop accepting QUIC-transported DNS, which removes the vulnerable receive path entirely - the trade-off is loss of DoQ service to clients relying on it. As a network control, restrict or block inbound UDP/443 (or the configured DoQ port) at the firewall so only trusted networks can reach the resolver, accepting that this narrows legitimate DoQ reachability. Reference the disclosure at https://openwall.com/lists/oss-security/2026/07/23/6 and the NVD page for tracking.
More in Knot Resolver
View allknot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. Rated high severity
Knot Resolver before 5.7.0 performs many TCP reconnections upon receiving certain nonsensical responses from servers. Ra
Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially c
Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic
Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a remote attacker in an edge case (NSEC3 wit
Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka
A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to do
A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allow
Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison c
Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filter
Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in
Vendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 5.3.1-1+deb11u1 | - |
| bookworm, bookworm (security) | vulnerable | 5.6.0-1+deb12u1 | - |
| trixie | vulnerable | 5.7.5-1 | - |
| forky | vulnerable | 6.4.0-1 | - |
| sid | fixed | 6.4.1-1 | - |
| (unstable) | fixed | 6.4.1-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today