Nlnet Labs vulnerabilities
96 CVEs and advisories name Nlnet Labs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-10846Insufficient verification that responses belong to a query
- CVE-2026-49235Routinator crashes on specifically crafted RRDP XML files
- CVE-2026-49234Routinator crashes on specifically crafted ASN strings in the API
- CVE-2026-49233Routinator cache path traversal using rogue rsync URIs
- CVE-2026-49232Routinator exits when accepting an incoming HTTP or RTR connection fails
- CVE-2026-44608Use after free and crash under special conditions in RPZ code
- CVE-2026-44390Unbounded name compression in certain cases causes degradation of service
- CVE-2026-42960Possible cache poisoning via promiscuous records for the authority section
- CVE-2026-42959Crash during DNSSEC validation of malicious content
- CVE-2026-42944Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- CVE-2026-42923Degradation of service with unbounded NSEC3 hash calculations
- CVE-2026-42534Jostle logic bypass degrades resolution performance
- CVE-2026-41292Long list of incoming EDNS options degrades performance
- CVE-2026-40622Another 'ghost domain names' attack variant
- CVE-2026-33278Possible arbitrary code execution during DNSSEC validation
- CVE-2026-32792Packet of death with DNSCrypt
- CVE-2025-11411Possible domain hijacking via promiscuous records in the authority section
- CVE-2025-5994Cache poisoning via the ECS-enabled Rebirthday Attack
- CVE-2025-0638Routinator crashes when illegal characters are present in manifest file names
- CVE-2024-8508Unbounded name compression could lead to Denial of Service
- CVE-2024-1931Denial of service when trimming EDE text on positive replies
- CVE-2024-1622Routinator terminates when RTR connection is reset too quickly after opening
- CVE-2023-39916Possible path traversal when storing RRDP responses
- CVE-2023-39915Crashes on parsing certain invalid RPKI objects
- CVE-2023-39914BER/CER/DER decoder panics on invalid input
- CVE-2023-0158Triggered crash on direct RRDP access
- CVE-2022-3204NRDelegation Attack
- CVE-2022-3029Fatal error on incorrect base64 data in RRDP
- CVE-2022-30699Novel "ghost domain names" attack by updating almost expired delegation information
- CVE-2022-30698Novel "ghost domain names" attack by introducing subdomain delegations