oss-sec mailing list archives

Re: Knot Resolver 6.3.0 DNS-over-QUIC heap buffer overflow (RCE)

From: Przemyslaw Frasunek <przemyslaw () frasunek com>
Date: Fri, 24 Jul 2026 08:43:38 +0200

Hello,

The following is a report of a remotely triggerable heap buffer
overflow in Knot Resolver's DNS-over-QUIC (DoQ) receive path, leading
to remote code execution. The issue was reported to CZ.NIC on
2026-06-08 and fixed in Knot Resolver 6.4.1, released on 2026-07-22.


It seems the vendor did not request a CVE for this issue, so I am asking for one.

Current thread:

Knot Resolver 6.3.0 DNS-over-QUIC heap buffer overflow (RCE) Przemyslaw Frasunek (Jul 23)
- Re: Knot Resolver 6.3.0 DNS-over-QUIC heap buffer overflow (RCE) Przemyslaw Frasunek (Jul 24)