# cve.now: Nlnet Labs

The newest entries naming Nlnet Labs as an affected vendor (up to 200), of 96 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109142](https://cve.now/CVE-2026-109142.md): Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server (CVSS 8.4)
- [CVE-2026-109141](https://cve.now/CVE-2026-109141.md): Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import (CVSS 8.4)
- [CVE-2026-109140](https://cve.now/CVE-2026-109140.md): Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token (CVSS 8.4)
- [CVE-2026-72758](https://cve.now/CVE-2026-72758.md): Routinator may exit on malformed ranges (CVSS 7.5)
- [CVE-2026-72757](https://cve.now/CVE-2026-72757.md): Routinator HTTP server becomes unavailable with many unclosed connections (CVSS 5.3)
- [CVE-2026-72756](https://cve.now/CVE-2026-72756.md): Routinator exits on malformed rsync URIs (CVSS 7.5)
- [CVE-2026-72755](https://cve.now/CVE-2026-72755.md): Routinator stores TA certificate in cache without validation (CVSS 3.8)
- [CVE-2026-72754](https://cve.now/CVE-2026-72754.md): Routinator exits when parsing an incorrect or very large CRL file (CVSS 7.5)
- [CVE-2026-72753](https://cve.now/CVE-2026-72753.md): Routinator incorrectly handles delta updates (CVSS 8.2)
- [CVE-2026-72752](https://cve.now/CVE-2026-72752.md): Routinator exits when requesting the output repeatedly (CVSS 6.5)
- [CVE-2026-97206](https://cve.now/CVE-2026-97206.md): DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. (CVSS 7.5)
- [CVE-2026-96405](https://cve.now/CVE-2026-96405.md): Aggregate DNS name chained pointer decompression work leads to degradation of service. (CVSS 5.3)
- [CVE-2026-50106](https://cve.now/CVE-2026-50106.md): Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. (CVSS 6.5)
- [CVE-2026-35501](https://cve.now/CVE-2026-35501.md): Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. (CVSS 3.7)
- [CVE-2026-109125](https://cve.now/CVE-2026-109125.md): Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold' (CVSS 5.3)
- [CVE-2026-101341](https://cve.now/CVE-2026-101341.md): Stack overwrite from specially formatted TXT-DATA RDATA field (CVSS 8.7)
- [CVE-2026-101339](https://cve.now/CVE-2026-101339.md): Stack overwrite from a specially crafted and formatted HIP RR (CVSS 8.7)
- [CVE-2026-101338](https://cve.now/CVE-2026-101338.md): Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR (CVSS 8.7)
- [CVE-2026-101337](https://cve.now/CVE-2026-101337.md): Stack overwrite from specially formatted base64 RDATA field (CVSS 8.7)
- [CVE-2026-85501](https://cve.now/CVE-2026-85501.md): Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (CVSS 5.3)
- [CVE-2026-82720](https://cve.now/CVE-2026-82720.md): Use-after-free in DoH stream cleanup code path (CVSS 5.9)
- [CVE-2026-82717](https://cve.now/CVE-2026-82717.md): CNAME synthesis could lead to heap corruption (CVSS 8.4)
- [CVE-2026-81642](https://cve.now/CVE-2026-81642.md): Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVSS 9.1)
- [CVE-2026-81634](https://cve.now/CVE-2026-81634.md): Possible heap buffer overflow during DNSSEC canonicalization (CVSS 7.5)
- [CVE-2026-80225](https://cve.now/CVE-2026-80225.md): Possible degradation of service from continuous queries on the same TCP/DoT connection (CVSS 5.3)
- [CVE-2026-78227](https://cve.now/CVE-2026-78227.md): Use-after-free in DoQ stream output buffer on reset re-transmission (CVSS 6.5)
- [CVE-2026-77955](https://cve.now/CVE-2026-77955.md): Possible ZONEMD verification bypass window (CVSS 4.4)
- [CVE-2026-77860](https://cve.now/CVE-2026-77860.md): 'serve-expired' can bypass Unbound 'wait-limit' (CVSS 3.7)
- [CVE-2026-19538](https://cve.now/CVE-2026-19538.md): Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS (CVSS 8.2)
- [CVE-2026-19401](https://cve.now/CVE-2026-19401.md): Remote UDP DoS by sending multiple DNS Cookie options (CVSS 8.2)
- [CVE-2026-18916](https://cve.now/CVE-2026-18916.md): Remote TCP DoS by throttling the TCP receive window (CVSS 6.9)
- [CVE-2026-18664](https://cve.now/CVE-2026-18664.md): Wrong interpretation of ACL ranges (CVSS 8.2)
- [CVE-2026-56444](https://cve.now/CVE-2026-56444.md): Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration (CVSS 5.9)
- [CVE-2026-56416](https://cve.now/CVE-2026-56416.md): Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (CVSS 4.8)
- [CVE-2026-55991](https://cve.now/CVE-2026-55991.md): Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 (CVSS 5.9)
- [CVE-2026-55990](https://cve.now/CVE-2026-55990.md): Packet of death for a DNSCrypt misconfigured Unbound (CVSS 5.9)
- [CVE-2026-55973](https://cve.now/CVE-2026-55973.md): 'dns-error-reporting: yes' leads to stack buffer overflow (CVSS 7.5)
- [CVE-2026-55717](https://cve.now/CVE-2026-55717.md): 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash (CVSS 5.9)
- [CVE-2026-55708](https://cve.now/CVE-2026-55708.md): Privacy/configuration issue when adding local data in views through 'unbound-control' (CVSS 3.1)
- [CVE-2026-54478](https://cve.now/CVE-2026-54478.md): DNS Cookie bypass when combined with proxy-protocol use (CVSS 3.7)
- [CVE-2026-52863](https://cve.now/CVE-2026-52863.md): Memory corruption could lead to crash and denial of service (CVSS 5.9)
- [CVE-2026-50252](https://cve.now/CVE-2026-50252.md): Possible cache poisoning attack by mapping source port population per thread (CVSS 5.7)
- [CVE-2026-50251](https://cve.now/CVE-2026-50251.md): Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush (CVSS 5.3)
- [CVE-2026-50248](https://cve.now/CVE-2026-50248.md): BOGUS configured primary hostname accepted for XFR in auth/rpz zones (CVSS 6.5)
- [CVE-2026-50243](https://cve.now/CVE-2026-50243.md): 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL (CVSS 6.3)
- [CVE-2026-50046](https://cve.now/CVE-2026-50046.md): Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (CVSS 5.9)
- [CVE-2026-50045](https://cve.now/CVE-2026-50045.md): 'max-global-quota' reset by DNSSEC validation restarts (CVSS 5.3)
- [CVE-2026-46582](https://cve.now/CVE-2026-46582.md): A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path (CVSS 3.7)
- [CVE-2026-44690](https://cve.now/CVE-2026-44690.md): Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (CVSS 7.5)
- [CVE-2026-44687](https://cve.now/CVE-2026-44687.md): Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (CVSS 3.7)
- [CVE-2026-44621](https://cve.now/CVE-2026-44621.md): Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated (CVSS 5.9)
- [CVE-2026-42955](https://cve.now/CVE-2026-42955.md): Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records (CVSS 3.7)
- [CVE-2026-41637](https://cve.now/CVE-2026-41637.md): Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries (CVSS 3.7)
- [CVE-2026-40691](https://cve.now/CVE-2026-40691.md): Packet of death for DNSCrypt over TCP (CVSS 7.5)
- [CVE-2026-32665](https://cve.now/CVE-2026-32665.md): Remote DNS-over-QUIC denial of service due to \`quic-size\` budget bypass (CVSS 7.5)
- [CVE-2026-14586](https://cve.now/CVE-2026-14586.md): Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments (CVSS 5.9)
- [CVE-2026-12490](https://cve.now/CVE-2026-12490.md): Bypass of client certificate verification with transfer over TLS (CVSS 8.2)
- [CVE-2026-12246](https://cve.now/CVE-2026-12246.md): Out of bounds stack write with crafted APL RR (CVSS 7.2)
- [CVE-2026-12245](https://cve.now/CVE-2026-12245.md): Denial of DNS over TLS service by any DoT client (CVSS 8.7)
- [CVE-2026-12244](https://cve.now/CVE-2026-12244.md): Heap overflow and crash with crafted SVCB RR (CVSS 8.7)
- [CVE-2026-10846](https://cve.now/CVE-2026-10846.md): Insufficient verification that responses belong to a query (CVSS 8.2)
- [CVE-2026-49235](https://cve.now/CVE-2026-49235.md): Routinator crashes on specifically crafted RRDP XML files (CVSS 8.7)
- [CVE-2026-49234](https://cve.now/CVE-2026-49234.md): Routinator crashes on specifically crafted ASN strings in the API (CVSS 8.2)
- [CVE-2026-49233](https://cve.now/CVE-2026-49233.md): Routinator cache path traversal using rogue rsync URIs (CVSS 8.3)
- [CVE-2026-49232](https://cve.now/CVE-2026-49232.md): Routinator exits when accepting an incoming HTTP or RTR connection fails (CVSS 8.7)
- [CVE-2026-44608](https://cve.now/CVE-2026-44608.md): Use after free and crash under special conditions in RPZ code (CVSS 4.6)
- [CVE-2026-44390](https://cve.now/CVE-2026-44390.md): Unbounded name compression in certain cases causes degradation of service (CVSS 6.9)
- [CVE-2026-42960](https://cve.now/CVE-2026-42960.md): Possible cache poisoning via promiscuous records for the authority section (CVSS 5.7)
- [CVE-2026-42959](https://cve.now/CVE-2026-42959.md): Crash during DNSSEC validation of malicious content (CVSS 8.7)
- [CVE-2026-42944](https://cve.now/CVE-2026-42944.md): Heap overflow with multiple NSID, COOKIE, PADDING EDNS options (CVSS 8.7)
- [CVE-2026-42923](https://cve.now/CVE-2026-42923.md): Degradation of service with unbounded NSEC3 hash calculations (CVSS 6.9)
- [CVE-2026-42534](https://cve.now/CVE-2026-42534.md): Jostle logic bypass degrades resolution performance (CVSS 6.9)
- [CVE-2026-41292](https://cve.now/CVE-2026-41292.md): Long list of incoming EDNS options degrades performance (CVSS 6.6)
- [CVE-2026-40622](https://cve.now/CVE-2026-40622.md): Another 'ghost domain names' attack variant (CVSS 6.6)
- [CVE-2026-33278](https://cve.now/CVE-2026-33278.md): Possible arbitrary code execution during DNSSEC validation (CVSS 9.1)
- [CVE-2026-32792](https://cve.now/CVE-2026-32792.md): Packet of death with DNSCrypt (CVSS 4.6)
- [CVE-2025-11411](https://cve.now/CVE-2025-11411.md): Possible domain hijacking via promiscuous records in the authority section (CVSS 5.7)
- [CVE-2025-5994](https://cve.now/CVE-2025-5994.md): Cache poisoning via the ECS-enabled Rebirthday Attack (CVSS 8.7)
- [CVE-2025-0638](https://cve.now/CVE-2025-0638.md): Routinator crashes when illegal characters are present in manifest file names (CVSS 7.5)
- [CVE-2024-8508](https://cve.now/CVE-2024-8508.md): Unbounded name compression could lead to Denial of Service (CVSS 5.3)
- [CVE-2024-1931](https://cve.now/CVE-2024-1931.md): Denial of service when trimming EDE text on positive replies (CVSS 7.5)
- [CVE-2024-1622](https://cve.now/CVE-2024-1622.md): Routinator terminates when RTR connection is reset too quickly after opening (CVSS 7.5)
- [CVE-2023-39916](https://cve.now/CVE-2023-39916.md): Possible path traversal when storing RRDP responses (CVSS 9.3)
- [CVE-2023-39915](https://cve.now/CVE-2023-39915.md): Crashes on parsing certain invalid RPKI objects (CVSS 7.5)
- [CVE-2023-39914](https://cve.now/CVE-2023-39914.md): BER/CER/DER decoder panics on invalid input (CVSS 7.5)
- [CVE-2023-0158](https://cve.now/CVE-2023-0158.md): Triggered crash on direct RRDP access (CVSS 7.5)
- [CVE-2022-3204](https://cve.now/CVE-2022-3204.md): NRDelegation Attack (CVSS 7.5)
- [CVE-2022-3029](https://cve.now/CVE-2022-3029.md): Fatal error on incorrect base64 data in RRDP (no CVSS)
- [CVE-2022-30699](https://cve.now/CVE-2022-30699.md): Novel "ghost domain names" attack by updating almost expired delegation information (no CVSS)
- [CVE-2022-30698](https://cve.now/CVE-2022-30698.md): Novel "ghost domain names" attack by introducing subdomain delegations (no CVSS)
- [CVE-2021-43174](https://cve.now/CVE-2021-43174.md): gzip transfer encoding caused out-of-memory crash (no CVSS)
- [CVE-2021-43173](https://cve.now/CVE-2021-43173.md): Hanging RRDP request (no CVSS)
- [CVE-2021-43172](https://cve.now/CVE-2021-43172.md): Infinite length chain of RRDP repositories (no CVSS)
- [CVE-2021-41531](https://cve.now/CVE-2021-41531.md): Invalid RPKI data could disable Route Origin Validation on RTR clients. (no CVSS)
- [CVE-2020-28935](https://cve.now/CVE-2020-28935.md): Local symlink attack in Unbound and NSD (no CVSS)
- [CVE-2017-15105](https://cve.now/CVE-2017-15105.md): A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nlnet-labs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.