Nlnet Labs

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-81642	A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.	CRITICAL	9.1	0.5%	46
CVE-2026-12245	Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenticated attacker to crash the server process by exploiting a heap use-after-free in the TLS error-logging path. By sending a DNS query over a DNS-over-TLS (DoT) connection and closing the socket before reading the response, an attacker triggers the freed-memory access trivially; no public exploit identified at time of analysis, and the issue is not in CISA KEV. The CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity exposure.	HIGH	8.7	0.3%	44
CVE-2026-12244	Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave) NSD instance by sending an AXFR transfer containing a crafted SVCB resource record. An rdata size of 65512 causes a uint16_t length variable used for RR allocation to wrap (total size exceeds 65535), producing an undersized buffer and a controlled out-of-bounds write of up to 65509 bytes - an RCE-class primitive (CWE-190 integer overflow leading to heap overflow). No public exploit identified at time of analysis, but the controlled write and remote network vector (CVSS 4.0 base 8.7) make this a high-priority patch for any operator running NSD as a secondary.	HIGH	8.7	0.3%	44
CVE-2026-49235	Denial of service in NLnet Labs Routinator allows remote attackers to crash the RPKI validator by serving a crafted Document Type Definition (DTD) inside RRDP repository content. Exploitation requires no authentication or user interaction (CVSS 4.0 8.7, VA:H), and no public exploit identified at time of analysis. A successful crash halts RPKI relying-party processing, which can degrade route origin validation for networks that depend on Routinator output.	HIGH	8.7	0.0%	44
CVE-2026-49232	Denial of service in NLnet Labs Routinator allows remote unauthenticated attackers to crash the daemon by opening a large number of HTTP or RTR connections, exhausting file descriptors and triggering an unrecoverable exit. Only deployments exposing the HTTP or RTR server to untrusted networks are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.	HIGH	8.7	0.0%	44	No patch
CVE-2026-82717	Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.	HIGH	8.4	0.4%	42
CVE-2026-49233	Path traversal in NLnet Labs Routinator allows remote attackers to escape the rsync cache directory by supplying rsync URIs whose module component contains '..' sequences, enabling read/write access across the entire Routinator rsync cache filesystem. The flaw is network-reachable and requires no authentication, and no public exploit identified at time of analysis. CVSS 4.0 of 8.3 reflects high integrity and availability impact with an attack requirement (AT:P) reducing it from critical.	HIGH	8.3	0.0%	42
CVE-2026-19538	NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.	HIGH	8.2	0.4%	41
CVE-2026-19401	NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.	HIGH	8.2	0.3%	41
CVE-2026-18664	IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatch in the range comparison logic. Both IPv4 and IPv6 addresses are compared as unsigned 32-bit integers using host byte order, while the actual stored values are in network byte order (big-endian), causing comparisons to produce incorrect results on the dominant x86/x86-64/ARM-LE server platforms. The practical consequence is a bidirectional access control bypass: operators relying on hyphen-range ACL syntax may inadvertently permit unauthorized IP addresses to access restricted DNS operations (such as zone transfers) while simultaneously denying legitimate clients. No public exploit has been identified at time of analysis, but the flaw is fully deterministic and requires no special attacker capability beyond network reachability.	HIGH	8.2	0.3%	41
CVE-2026-12490	Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents without presenting the required TLS client certificate. Although a provide-xfr rule specifies a tls-auth-name (mandating client-certificate authentication), NSD only enforces this on the dedicated tls-auth-port; requests arriving over plain TCP on the regular port or over TLS on the regular tls-port are served when the remaining provide-xfr conditions match, defeating mutual-TLS access control. Reported by NLnet Labs with CVSS 4.0 8.2; no public exploit identified at time of analysis and not listed in CISA KEV.	HIGH	8.2	0.1%	41
CVE-2026-49234	Denial of service in NLnet Labs Routinator (an RPKI Relying Party software) allows remote attackers to crash the daemon by sending a specifically crafted non-UTF-8 string in the select-asn query parameter to the /api/v1/origins HTTP endpoint. The flaw only impacts deployments that expose the API to untrusted networks, and no public exploit has been identified at time of analysis. CVSS 4.0 base score is 8.2 driven by high availability impact to both the vulnerable component and downstream RPKI consumers.	HIGH	8.2	0.0%	41
CVE-2026-10846	Off-path DNS response spoofing in NLnet Labs ldns 1.2.0 through 1.9.0 allows remote attackers to inject forged answers into applications that use the library as a UDP stub resolver, including the bundled drill tool. The library fails to validate the response source address/port, the query transaction ID, and the question section against the original query, making cache and answer poisoning feasible without on-path positioning. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.2 reflects high integrity impact on any downstream application that trusted ldns to validate DNS answers.	HIGH	8.2	0.0%	41
CVE-2026-32665	Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured memory when downstream DNS-over-QUIC (DoQ) is enabled. The first two bidirectional QUIC streams (stream_id 0 and 4) skip the per-stream 'quic-size' accounting gate, so large input buffers are allocated after only a 2-byte length prefix arrives, letting a single connection with two streams force Unbound to allocate roughly double the configured limit at near-zero attacker cost. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the mechanics are trivial and fully described by the vendor advisory.	HIGH	7.5	0.5%	38
CVE-2026-40691	Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recursive DNS resolver by sending a single malicious encrypted DNSCrypt query over TCP. The TCP in-place encryption routine omits the reply-length clamp that protects the UDP path, so an oversized reply is shifted 48 bytes forward past the end of a heap allocation sized to 'msg-buffer-size' (CWE-122). Only builds compiled with '--enable-dnscrypt' and an active 'dnscrypt:' clause are affected; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.	HIGH	7.5	0.5%	38

CVE-2026-81642

A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.

CRITICAL

9.1

0.5%

46

CVE-2026-12245

Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenticated attacker to crash the server process by exploiting a heap use-after-free in the TLS error-logging path. By sending a DNS query over a DNS-over-TLS (DoT) connection and closing the socket before reading the response, an attacker triggers the freed-memory access trivially; no public exploit identified at time of analysis, and the issue is not in CISA KEV. The CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity exposure.

HIGH

8.7

0.3%

44

CVE-2026-12244

Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave) NSD instance by sending an AXFR transfer containing a crafted SVCB resource record. An rdata size of 65512 causes a uint16_t length variable used for RR allocation to wrap (total size exceeds 65535), producing an undersized buffer and a controlled out-of-bounds write of up to 65509 bytes - an RCE-class primitive (CWE-190 integer overflow leading to heap overflow). No public exploit identified at time of analysis, but the controlled write and remote network vector (CVSS 4.0 base 8.7) make this a high-priority patch for any operator running NSD as a secondary.

HIGH

8.7

0.3%

44

CVE-2026-49235

Denial of service in NLnet Labs Routinator allows remote attackers to crash the RPKI validator by serving a crafted Document Type Definition (DTD) inside RRDP repository content. Exploitation requires no authentication or user interaction (CVSS 4.0 8.7, VA:H), and no public exploit identified at time of analysis. A successful crash halts RPKI relying-party processing, which can degrade route origin validation for networks that depend on Routinator output.

HIGH

8.7

0.0%

44

CVE-2026-49232

Denial of service in NLnet Labs Routinator allows remote unauthenticated attackers to crash the daemon by opening a large number of HTTP or RTR connections, exhausting file descriptors and triggering an unrecoverable exit. Only deployments exposing the HTTP or RTR server to untrusted networks are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

HIGH

8.7

0.0%

44

No patch

CVE-2026-82717

Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.

HIGH

8.4

0.4%

42

CVE-2026-49233

Path traversal in NLnet Labs Routinator allows remote attackers to escape the rsync cache directory by supplying rsync URIs whose module component contains '..' sequences, enabling read/write access across the entire Routinator rsync cache filesystem. The flaw is network-reachable and requires no authentication, and no public exploit identified at time of analysis. CVSS 4.0 of 8.3 reflects high integrity and availability impact with an attack requirement (AT:P) reducing it from critical.

HIGH

8.3

0.0%

42

CVE-2026-19538

NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.

HIGH

8.2

0.4%

41

CVE-2026-19401

NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

HIGH

8.2

0.3%

41

CVE-2026-18664

IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatch in the range comparison logic. Both IPv4 and IPv6 addresses are compared as unsigned 32-bit integers using host byte order, while the actual stored values are in network byte order (big-endian), causing comparisons to produce incorrect results on the dominant x86/x86-64/ARM-LE server platforms. The practical consequence is a bidirectional access control bypass: operators relying on hyphen-range ACL syntax may inadvertently permit unauthorized IP addresses to access restricted DNS operations (such as zone transfers) while simultaneously denying legitimate clients. No public exploit has been identified at time of analysis, but the flaw is fully deterministic and requires no special attacker capability beyond network reachability.

HIGH

8.2

0.3%

41

CVE-2026-12490

Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents without presenting the required TLS client certificate. Although a provide-xfr rule specifies a tls-auth-name (mandating client-certificate authentication), NSD only enforces this on the dedicated tls-auth-port; requests arriving over plain TCP on the regular port or over TLS on the regular tls-port are served when the remaining provide-xfr conditions match, defeating mutual-TLS access control. Reported by NLnet Labs with CVSS 4.0 8.2; no public exploit identified at time of analysis and not listed in CISA KEV.

HIGH

8.2

0.1%

41

CVE-2026-49234

Denial of service in NLnet Labs Routinator (an RPKI Relying Party software) allows remote attackers to crash the daemon by sending a specifically crafted non-UTF-8 string in the select-asn query parameter to the /api/v1/origins HTTP endpoint. The flaw only impacts deployments that expose the API to untrusted networks, and no public exploit has been identified at time of analysis. CVSS 4.0 base score is 8.2 driven by high availability impact to both the vulnerable component and downstream RPKI consumers.

HIGH

8.2

0.0%

41

CVE-2026-10846

Off-path DNS response spoofing in NLnet Labs ldns 1.2.0 through 1.9.0 allows remote attackers to inject forged answers into applications that use the library as a UDP stub resolver, including the bundled drill tool. The library fails to validate the response source address/port, the query transaction ID, and the question section against the original query, making cache and answer poisoning feasible without on-path positioning. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.2 reflects high integrity impact on any downstream application that trusted ldns to validate DNS answers.

HIGH

8.2

0.0%

41

CVE-2026-32665

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured memory when downstream DNS-over-QUIC (DoQ) is enabled. The first two bidirectional QUIC streams (stream_id 0 and 4) skip the per-stream 'quic-size' accounting gate, so large input buffers are allocated after only a 2-byte length prefix arrives, letting a single connection with two streams force Unbound to allocate roughly double the configured limit at near-zero attacker cost. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the mechanics are trivial and fully described by the vendor advisory.

HIGH

7.5

0.5%

38

CVE-2026-40691

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recursive DNS resolver by sending a single malicious encrypted DNSCrypt query over TCP. The TCP in-place encryption routine omits the reply-length clamp that protects the UDP path, so an oversized reply is shifted 48 bytes forward past the end of a heap allocation sized to 'msg-buffer-size' (CWE-122). Only builds compiled with '--enable-dnscrypt' and an active 'dnscrypt:' clause are affected; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

HIGH

7.5

0.5%

38

Severity Breakdown

Monthly CVE Trend

Affected Products (4)

Top Risky CVEs