Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

Use-after-free in DoQ stream output buffer on reset re-transmission

BOGUS configured primary hostname accepted for XFR in auth/rpz zones

Novel "ghost domain names" attack by updating almost expired delegation information

Novel "ghost domain names" attack by introducing subdomain delegations

Use-after-free in DoH stream cleanup code path

Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

Packet of death for a DNSCrypt misconfigured Unbound

'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

Memory corruption could lead to crash and denial of service

Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated

Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments

Use after free and crash under special conditions in RPZ code

Aggregate DNS name chained pointer decompression work leads to degradation of service.

Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'

Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

'max-global-quota' reset by DNSSEC validation restarts

Unbounded name compression in certain cases causes degradation of service

Degradation of service with unbounded NSEC3 hash calculations

Jostle logic bypass degrades resolution performance

Packet of death with DNSCrypt

Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

Possible ZONEMD verification bypass window