Nlnet Labs vulnerabilities
96 CVEs and advisories name Nlnet Labs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-109142Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server
- CVE-2026-109141Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import
- CVE-2026-109140Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token
- CVE-2026-72758Routinator may exit on malformed ranges
- CVE-2026-72757Routinator HTTP server becomes unavailable with many unclosed connections
- CVE-2026-72756Routinator exits on malformed rsync URIs
- CVE-2026-72755Routinator stores TA certificate in cache without validation
- CVE-2026-72754Routinator exits when parsing an incorrect or very large CRL file
- CVE-2026-72753Routinator incorrectly handles delta updates
- CVE-2026-72752Routinator exits when requesting the output repeatedly
- CVE-2026-97206DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
- CVE-2026-96405Aggregate DNS name chained pointer decompression work leads to degradation of service.
- CVE-2026-50106Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.
- CVE-2026-35501Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.
- CVE-2026-109125Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'
- CVE-2026-101341Stack overwrite from specially formatted TXT-DATA RDATA field
- CVE-2026-101339Stack overwrite from a specially crafted and formatted HIP RR
- CVE-2026-101338Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR
- CVE-2026-101337Stack overwrite from specially formatted base64 RDATA field
- CVE-2026-85501Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC
- CVE-2026-82720Use-after-free in DoH stream cleanup code path
- CVE-2026-82717CNAME synthesis could lead to heap corruption
- CVE-2026-81642Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- CVE-2026-81634Possible heap buffer overflow during DNSSEC canonicalization
- CVE-2026-80225Possible degradation of service from continuous queries on the same TCP/DoT connection
- CVE-2026-78227Use-after-free in DoQ stream output buffer on reset re-transmission
- CVE-2026-77955Possible ZONEMD verification bypass window
- CVE-2026-77860'serve-expired' can bypass Unbound 'wait-limit'
- CVE-2026-19538Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
- CVE-2026-19401Remote UDP DoS by sending multiple DNS Cookie options