- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 5 excluded.
Web 1
- https://www.nlnetlabs.nl/projects/nsd/about
Products and areas 10
- DNSSEC handling for pre-signed zones, including NSEC and NSEC3 answering and the DNSSEC record types
- EDNS handling, DNS cookies and the extension mechanisms attached to modern queries
- NLnet Labs takes security reports for all of its software at a single entry point and declares nothing narrower than the project itself, so all of NSD is in
- nsd-control and its control channel, including the certificate-based authentication on it
- Query handling end to end: the wire-format parser, the answer construction path and every record type NSD serves
- Rate limiting, response-rate limiting and the access-control lists deciding which peer may do what
- The process model: privilege dropping, chroot handling and the state shared between server processes
- The zone-file parser and the zone compiler, which read operator data and data arriving over a transfer
- XFR-over-TLS, including certificate verification on both ends, the surface that produced CVE-2026-12490
- Zone transfer as primary and as secondary, covering AXFR, IXFR, NOTIFY and the TSIG authentication around them
Out of scope (5)
- Configuration choices such as an allow-transfer entry broader than the operator intended
- Distribution packaging and forks carrying local patches rather than upstream NSD
- Reflection and amplification against an authoritative server, which is a property of the protocol absent a defect in NSD's own rate limiting
- Unbound, ldns, Routinator and Krill, which share the reporting address and are separate codebases
- Zone content the operator published, including data that is simply wrong rather than a parser defect
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report to the address on the policy page , the Security Entry Point covering all NLnet Labs software, encrypted to the fingerprint published on its security page
-
GitHub private vulnerability reporting is disabled on the NLnet Labs repositories, so this email is the only private channel
-
Name NSD in the first line. The same address handles Unbound, ldns, Routinator and Krill
-
Include the zone data or the transfer configuration that reproduces it.
-
Check current code first. NSD releases regularly and the four recent CVEs were all fixed in the same round
Not accepted
-
Zone content the operator published, including data that is simply wrong rather than a parser defect
-
Reflection and amplification against an authoritative server, which is a property of the protocol absent a defect in NSD's own rate limiting
-
Configuration choices such as an allow-transfer entry broader than the operator intended
-
Distribution packaging and forks carrying local patches rather than upstream NSD
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-82717 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the | High 8.4 | 16 Sep 2026 |
| CVE-2026-82720 | NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those | Medium 5.9 | 16 Sep 2026 |
| CVE-2026-85501 | Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a sign | Medium 5.3 | 16 Sep 2026 |
| CVE-2026-77860 | In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Ea | Low 3.7 | 16 Sep 2026 |
| CVE-2026-77955 | In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZO | Medium 4.4 | 16 Sep 2026 |
| CVE-2026-78227 | NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but | Medium 6.5 | 16 Sep 2026 |
| CVE-2026-80225 | In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain. | Medium 5.3 | 16 Sep 2026 |
| CVE-2026-81634 | In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNS | High 7.5 | 16 Sep 2026 |
| CVE-2026-81642 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerabili | Critical 9.1 | 16 Sep 2026 |
| CVE-2026-19538 | The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open. | High 8.2 | 26 Aug 2026 |
| CVE-2026-18916 | Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance. | Medium 6.9 | 26 Aug 2026 |
| CVE-2026-19401 | Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service. | High 8.2 | 26 Aug 2026 |
| CVE-2026-18664 | When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the valu | High 8.2 | 26 Aug 2026 |
| CVE-2026-55717 | In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME | Medium 5.9 | 22 Jul 2026 |
| CVE-2026-55973 | In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are mov | High 7.5 | 22 Jul 2026 |
| CVE-2026-55990 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, | Medium 5.9 | 22 Jul 2026 |
| CVE-2026-55991 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_ | Medium 5.9 | 22 Jul 2026 |
| CVE-2026-56416 | In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser ac | Medium 4.8 | 22 Jul 2026 |
| CVE-2026-56444 | In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branc | Medium 5.9 | 22 Jul 2026 |
| CVE-2026-50251 | In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on loop | Medium 5.3 | 22 Jul 2026 |
| CVE-2026-50252 | In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming so | Medium 5.7 | 22 Jul 2026 |
| CVE-2026-52863 | In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach | Medium 5.9 | 22 Jul 2026 |
| CVE-2026-54478 | In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy- | Low 3.7 | 22 Jul 2026 |
| CVE-2026-55708 | In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, | Low 3.1 | 22 Jul 2026 |
| CVE-2026-50045 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic. | Medium 5.3 | 22 Jul 2026 |
| CVE-2026-50046 | In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then | Medium 5.9 | 22 Jul 2026 |
| CVE-2026-50243 | In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. If the validator | Medium 6.3 | 22 Jul 2026 |
| CVE-2026-50248 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy. | Medium 6.5 | 22 Jul 2026 |
| CVE-2026-41637 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issu | Low 3.7 | 22 Jul 2026 |
| CVE-2026-42955 | In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulner | Low 3.7 | 22 Jul 2026 |
| CVE-2026-44621 | With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any | Medium 5.9 | 22 Jul 2026 |
| CVE-2026-44687 | In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic; enabled by default. It effectively bypasses the configuration and the configured stub/forw | Low 3.7 | 22 Jul 2026 |
| CVE-2026-44690 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an | High 7.5 | 22 Jul 2026 |
| CVE-2026-46582 | In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up t | Low 3.7 | 22 Jul 2026 |
| CVE-2026-32665 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Un | High 7.5 | 22 Jul 2026 |
| CVE-2026-40691 | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', w | High 7.5 | 22 Jul 2026 |
| CVE-2026-12244 | If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 6550 | High 8.7 | 25 Jun 2026 |
| CVE-2026-12245 | NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response. | High 8.7 | 25 Jun 2026 |
| CVE-2026-12246 | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes. | High 7.2 | 25 Jun 2026 |
| CVE-2026-12490 | When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match. | High 8.2 | 25 Jun 2026 |
| CVE-2026-10846 | NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulne | High 8.2 | 10 Jun 2026 |
| CVE-2026-49233 | Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache. | High 8.3 | 8 Jun 2026 |
| CVE-2026-49234 | When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks. | High 8.2 | 8 Jun 2026 |
| CVE-2026-49235 | When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes. | High 8.7 | 8 Jun 2026 |
| CVE-2026-42923 | NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with | Medium 6.9 | 20 May 2026 |
| CVE-2026-42944 | NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulner | High 8.7 | 20 May 2026 |
| CVE-2026-42959 | NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority fi | High 8.7 | 20 May 2026 |
| CVE-2026-42960 | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cach | Medium 5.7 | 20 May 2026 |
| CVE-2026-44390 | NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded p | Medium 6.9 | 20 May 2026 |
| CVE-2026-44608 | NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, a | Medium 4.6 | 20 May 2026 |
| CVE-2026-33278 | NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-quer | Critical 9.1 | 20 May 2026 |
| CVE-2026-40622 | NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrit | Medium 6.6 | 20 May 2026 |
| CVE-2026-41292 | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Un | Medium 6.6 | 20 May 2026 |
| CVE-2026-42534 | NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can | Medium 6.9 | 20 May 2026 |
| CVE-2026-32792 | NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of | Medium 4.6 | 20 May 2026 |
| CVE-2024-8508 | NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well o | Medium 5.3 | 3 Oct 2024 |
| CVE-2024-1931 | NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming the | High 7.5 | 7 Mar 2024 |
| CVE-2024-1622 | Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening. | High 7.5 | 26 Feb 2024 |
| CVE-2023-50387 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKE | High 7.5 | 14 Feb 2024 |
| CVE-2023-39916 | NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitat | Critical 9.3 | 13 Sep 2023 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months Access control 35 % Denial of service 30 % Parsing/validation 20 % Memory safety 15 % Latest advisories Loading the feed Overview NSD is NLnet Labs' authoritative nameserver, built to serve zones and nothing else. It runs root-server instances and is the reference choice for operators who want an authoritative server with no resolver attached. Its record was two CVEs in the project's entire history until June 2026, when four High-severity ones landed on a single day. CVE-2026-12490 is the one to read: client certificate verification could be bypassed on zone transfer over TLS, so a peer with no right to pull a zone could pull it anyway. NLnet Labs pays nothing and says so in writing. sorona.xyz pays you directly on qualified, reproduced findings. In scope NLnet Labs takes security reports for all of its software at a single entry point and declares nothing narrower than the project itself, so all of NSD is in Query handling end to end: the wire-format parser, the answer construction path and every record type NSD serves Zone transfer as primary and as secondary, covering AXFR, IXFR, NOTIFY and the TSIG authentication around them XFR-over-TLS, including certificate verification on both ends, the surface that produced CVE-2026-12490 The zone-file parser and the zone compiler, which read operator data and data arriving over a transfer DNSSEC handling for pre-signed zones, including NSEC and NSEC3 answering and the DNSSEC record types nsd-control and its control channel, including the certificate-based authentication on it Rate limiting, response-rate limiting and the access-control lists deciding which peer may do what The process model: privilege dropping, chroot handling and the state shared between server processes EDNS handling, DNS cookies and the extension mechanisms attached to modern queries Out of scope Unbound, ldns, Routinator and Krill, which share the reporting address and are separate codebases Zone content the operator published, including data that is simply wrong rather than a parser defect Reflection and amplification against an authoritative server, which is a property of the protocol absent a defect in NSD's own rate limiting Configuration choices such as an allow-transfer entry broader than the operator intended Distribution packaging and forks carrying local patches rather than upstream NSD Most-valued findings Zone transfer authentication and authorisation. CVE-2026-12490 bypassed client certificate verification on XFR-over-TLS, and an unauthorised zone pull hands over an operator's entire namespace The rest of the June 2026 batch is the map: CVE-2026-12244 through -12246 all landed High on the same day, so transfer and TLS handling is where current attention sits Memory corruption in query parsing reachable from ordinary traffic, on a server whose whole job is answering the public internet Anything that makes NSD serve an answer it should not have, since a wrong answer from an authoritative server is authoritative everywhere downstream Crashes or assertion failures reachable without authentication, given a deployment set that includes root-server instances where availability is the product Control-channel defects in nsd-control, where reaching the control socket means changing what a nameserver serves Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to [email protected] , the Security Entry Point covering all NLnet Labs software, encrypted to the fingerprint published on its security page GitHub private vulnerability reporting is disabled on the NLnet Labs repositories, so this email is the only private channel Name NSD in the first line. The same address handles Unbound, ldns, Routinator and Krill Include the zone data or the transfer configuration that reproduces it. The June 2026 batch turned on transfer and TLS handling rather than on ordinary query traffic Check current code first. NSD releases regularly and the four recent CVEs were all fixed in the same round NLnet Labs credits reporters when it releases fixes and states plainly that it pays nothing for them Disclosure Coordinated by email with NLnet Labs, then published as a vendor advisory with a fixed release and credit for the reporter. The June 2026 round shows the pattern: four CVEs assigned and published together on one day rather than dripped out. Expect the embargo to run to the next security release, and note that root-server operators consume these advisories directly, so the coordination reaches further than the CVE list suggests. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability