Loading story…
A remotely triggerable heap buffer overflow in Knot Resolver 6.3.0 allows unauthenticated remote code execution through the kresd DNS-over-QUIC listener. The flaw stems from incorrect size tracking during inbound QUIC STREAM frame reassembly, causing a later memcpy() to write past an allocated heap buffer. Public reporting said a single QUIC connection carrying six crafted STREAM frames can produce a controlled out-of-bounds write and, with heap grooming, overwrite a libgnutls cleanup handler to seize control of a function pointer and argument. Researchers classified the issue as CWE-787 and demonstrated end-to-end RCE in a Debian 12 lab environment with ASLR disabled; failed attempts can also crash worker processes and cause denial of service.
CZ.NIC fixed the vulnerability in Knot Resolver 6.4.1, and full technical details plus working proof-of-concept exploit code were disclosed publicly shortly after the patch release. No in-the-wild exploitation has been confirmed, but the exposure is significant because Knot Resolver is deployed by major ISPs and handles untrusted network traffic, raising the risk of resolver compromise and forged DNS responses for downstream users. Organizations are being urged to upgrade to 6.4.1 immediately; if patching cannot be completed at once, defenders should disable DNS-over-QUIC, restrict access to the DoQ service, and monitor for repeated kresd worker crashes that could indicate exploitation attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CZ.NIC released Knot Resolver 6.4.1 to fix the remotely triggerable DNS-over-QUIC heap out-of-bounds write in version 6.3.0. The coordinated disclosure write-up identifies 2026-07-22 as the fix release date.
A researcher publicly released full technical details and working proof-of-concept exploit code for the Knot Resolver DNS-over-QUIC vulnerability. The write-up described how crafted QUIC STREAM frames could achieve end-to-end RCE in a lab environment.
CZ.NIC fixed the DNS-over-QUIC heap out-of-bounds write in Knot Resolver by releasing version 6.4.1. The vulnerable version identified in the references is Knot Resolver 6.3.0.
A remotely triggerable heap buffer overflow in Knot Resolver 6.3.0's DNS-over-QUIC receive path was reported to CZ.NIC. The flaw could lead to unauthenticated remote code execution or, at minimum, worker-process crashes causing denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcegithub.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A heap buffer overflow in **Dnsmasq** tracked as `CVE-2026-2291` can be triggered when the resolver processes malicious DNS replies from an upstream DNS server, allowing memory corruption, false cache entry injection, DNS redirection, and denial of service. The flaw affects code introduced in release `2.73` and is tied to unsafe `strcpy()` use during cache insertion after `extract_name()` converts DNS names from wire format into C strings, where escaped names can exceed the `1,025`-byte `bigname` heap buffer. Researchers reported practical exploitation against **OpenWRT 24.10.4** configured to use a malicious upstream resolver, using crafted requests and CNAME chains to corrupt the `bigname` free list, obtain a write-what-where primitive, and overwrite a function pointer in musl `ld.so` to gain instruction-pointer control. The issue was fixed on 11 May 2026 in versions `2.92rel2` and `2.93`, and public reporting warns that exposed deployments could face DNS hijacking or, under the demonstrated conditions, full remote code execution.
Jul 20, 2026
NLnet Labs has addressed multiple vulnerabilities in the **Unbound** DNS resolver, including **`CVE-2026-33278`**, a high-severity flaw in the DNSSEC validator that can cause denial of service and potentially **remote code execution**. The bug affects Unbound versions **`1.19.1` through `1.25.0`** and stems from a deep-copy error that overwrites a destination pointer, later triggering a dangling-pointer dereference. The issue is tracked under **`CWE-416`** and **`CWE-672`** and carries high potential impact to confidentiality, integrity, and availability. Exploitation requires an attacker to control a malicious signed DNS zone and induce a vulnerable Unbound instance to query it while a **DS sub-query** is suspended because of **NSEC3 computational budget exhaustion**. Belgium's Centre for Cybersecurity warned that the Unbound vulnerabilities could enable denial-of-service and urged organizations to patch immediately. The vendor has fixed the issue in **Unbound `1.25.1`**, making upgrade a priority for operators using affected resolver versions.
Jun 29, 2026
Internet Systems Consortium (ISC) disclosed six vulnerabilities in **BIND 9** and released patched versions `9.18.49`, `9.20.23`, and `9.21.22`. The issues include **CVE-2026-3039**, a high-severity memory-exhaustion flaw during GSS-API TKEY negotiation that can crash `named`; **CVE-2026-3593**, a high-severity heap use-after-free in the DNS-over-HTTPS implementation triggered by crafted HTTP/2 traffic; **CVE-2026-3592**, an amplification issue involving self-pointed glue records that can drive disproportionate bandwidth and resource consumption; **CVE-2026-5947**, a race condition in SIG(0) validation under query-flood conditions that can lead to undefined behavior and process crashes; plus additional flaws involving invalid handling of `CLASS != IN` and an unbounded resend loop in the resolver. ISC said the vulnerabilities are remotely exploitable in affected configurations, with the most serious impacts centered on denial of service, memory corruption, and resolver abuse rather than confirmed code execution. Exposure depends on feature use: the GSS-API issue is especially relevant to Active Directory-integrated or Kerberos-secured DNS deployments, while the DoH flaw affects only servers with DNS-over-HTTPS enabled and can be mitigated by disabling that feature until upgrades are applied. ISC reported no known active exploitation at disclosure time, said no workaround is known for several of the bugs, and credited external researchers including Vitaly Simonovich, Naoki Wakamatsu, Naresh Kandula Parmar, and Shuhan Zhang for reporting the flaws.
Jun 29, 2026