Log in Start free

NLnet Labs

Products

ProductCVEsExploitedLatest
Unbound57–Oct 21, 2026
Routinator20–Oct 26, 2026
NSD13–Oct 14, 2026
Krill4–Nov 2, 2026
bcder1–Sep 13, 2023
ldns1–Jun 10, 2026

Exploited and recent CVEs

  • CVE-2026-109142 High 8.4 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server 0.3%
  • CVE-2026-109141 High 8.4 Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import 0.3%
  • CVE-2026-109140 High 8.4 Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token 0.3%
  • CVE-2026-72758 High 7.5 Routinator may exit on malformed ranges 0.4%
  • CVE-2026-72757 Medium 5.3 Routinator HTTP server becomes unavailable with many unclosed connections 0.4%
  • CVE-2026-72756 High 7.5 Routinator exits on malformed rsync URIs 0.4%
  • CVE-2026-72755 Low 3.8 Routinator stores TA certificate in cache without validation 0.2%
  • CVE-2026-72754 High 7.5 Routinator exits when parsing an incorrect or very large CRL file 0.4%
  • CVE-2026-72753 High 8.2 Routinator incorrectly handles delta updates 0.4%
  • CVE-2026-72752 Medium 6.5 Routinator exits when requesting the output repeatedly 0.2%
  • CVE-2026-97206 High 7.5 DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. 0.3%
  • CVE-2026-96405 Medium 5.3 Aggregate DNS name chained pointer decompression work leads to degradation of service. 0.3%
  • CVE-2026-50106 Medium 6.5 Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. 0.2%
  • CVE-2026-35501 Low 3.7 Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. 0.1%
  • CVE-2026-109125 Medium 5.3 Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold' 0.2%
  • CVE-2026-101341 High 8.7 Stack overwrite from specially formatted TXT-DATA RDATA field 0.3%
  • CVE-2026-101339 High 8.7 Stack overwrite from a specially crafted and formatted HIP RR 0.3%
  • CVE-2026-101338 High 8.7 Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR 0.3%
  • CVE-2026-101337 High 8.7 Stack overwrite from specially formatted base64 RDATA field 0.3%
  • CVE-2026-85501 Medium 5.3 Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC 0.5%
  • CVE-2026-82720 Medium 5.9 Use-after-free in DoH stream cleanup code path 0.4%
  • CVE-2026-82717 High 8.4 CNAME synthesis could lead to heap corruption 0.8%
  • CVE-2026-81642 Critical 9.1 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY 1.0%
  • CVE-2026-81634 High 7.5 Possible heap buffer overflow during DNSSEC canonicalization 0.5%
  • CVE-2026-80225 Medium 5.3 Possible degradation of service from continuous queries on the same TCP/DoT connection 0.5%
  • CVE-2026-78227 Medium 6.5 Use-after-free in DoQ stream output buffer on reset re-transmission 0.3%
  • CVE-2026-77955 Medium 4.4 Possible ZONEMD verification bypass window 0.2%
  • CVE-2026-77860 Low 3.7 'serve-expired' can bypass Unbound 'wait-limit' 0.3%
  • CVE-2026-19538 High 8.2 Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS 0.4%
  • CVE-2026-19401 High 8.2 Remote UDP DoS by sending multiple DNS Cookie options 0.5%