Possible cache poisoning via promiscuous records for the authority section

CNAME synthesis could lead to heap corruption

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

Possible arbitrary code execution during DNSSEC validation

Possible cache poisoning attack by mapping source port population per thread

DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC

Possible heap buffer overflow during DNSSEC canonicalization

Possible degradation of service from continuous queries on the same TCP/DoT connection

'dns-error-reporting: yes' leads to stack buffer overflow

Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

Packet of death for DNSCrypt over TCP

Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass

Crash during DNSSEC validation of malicious content

Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

Long list of incoming EDNS options degrades performance

Another 'ghost domain names' attack variant

Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

Use-after-free in DoQ stream output buffer on reset re-transmission

BOGUS configured primary hostname accepted for XFR in auth/rpz zones

Novel "ghost domain names" attack by updating almost expired delegation information

Novel "ghost domain names" attack by introducing subdomain delegations

Use-after-free in DoH stream cleanup code path

Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

Packet of death for a DNSCrypt misconfigured Unbound

'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

Memory corruption could lead to crash and denial of service

Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated

Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments

Use after free and crash under special conditions in RPZ code

Aggregate DNS name chained pointer decompression work leads to degradation of service.

Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'

Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

'max-global-quota' reset by DNSSEC validation restarts

Unbounded name compression in certain cases causes degradation of service

Degradation of service with unbounded NSEC3 hash calculations

Jostle logic bypass degrades resolution performance

Packet of death with DNSCrypt

Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

Possible ZONEMD verification bypass window

Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.

'serve-expired' can bypass Unbound 'wait-limit'

DNS Cookie bypass when combined with proxy-protocol use

'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path

Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries