4 hours 55 minutes ago
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04
LTS. (CVE-2025-8677)
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind
incorrectly accepted certain records from answers. A remote attacker could
possibly use this issue to perform a cache poisoning attack. This issue
only affected Ubuntu 18.04 LTS. (CVE-2025-40778)
Samy Medjahed discovered that Bind incorrectly handled insecure delegation
validation. A remote attacker could possibly use this issue to cause
excessive NSEC3 iterations, consuming CPU resources, and leading to a
denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519)
It was discovered that Bind incorrectly accepted NSEC3 records whose signer
name did not match the owning zone. A remote attacker could possibly use
this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC
validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723)
It was discovered that Bind incorrectly handled Key Records using the
PRIVATEDNS algorithm. A remote attacker could possibly use this issue to
cause Bind to crash, resulting in a denial of service. This issue only
affected Ubuntu 20.04 LTS. (CVE-2026-10822)
It was discovered that Bind incorrectly handled wildcard CNAME expansion in
Response Policy Zones. A remote attacker could possibly use this issue to
bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS.
(CVE-2026-11331)
It was discovered that Bind incorrectly tracked memory usage in the DNS
cache. A remote attacker could possibly use this issue to cause Bind to use
memory beyond configured limits, leading to a denial of service. This issue
only affected Ubuntu 20.04 LTS. (CVE-2026-11622)
It was discovered that Bind incorrectly handled signed wildcard records
with label count discrepancies and RRSIG validation. A remote attacker
could possibly use this issue to perform cache poisoning attacks. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
and Ubuntu 20.04 LTS. (CVE-2026-11721)
It was discovered that Bind incorrectly handled DNSSEC validation when a
domain was covered by both NSEC and NSEC3 records with only one type having
an RRSIG. A remote attacker could possibly use this issue to cause Bind to
crash, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-13204)
It was discovered that Bind incorrectly validated out-of-zone NSEC next
owner names during DNSSEC validation. A remote attacker could possibly use
this issue to bypass DNSSEC validation. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-13321)
It was discovered that Bind incorrectly served zone transfer data before
verifying the TSIG signature on multi-message transfers. A remote attacker
could possibly use this issue to send unauthorized zone contents to a
secondary server. (CVE-2026-19033)
It was discovered that Bind incorrectly handled the lifetime of cached
DNSSEC proofs, leading to a use-after-free. A remote attacker could
possibly use this issue to cause Bind to crash, resulting in a denial of
service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662)
It was discovered that Bind incorrectly handled certain malformed answers
when configured to use DNS64. A remote attacker could possibly use this
issue to cause Bind to crash, resulting in a denial of service.
(CVE-2026-19666)
It was discovered that Bind incorrectly handled oversized negative answers
when storing them in the negative cache. A remote attacker could possibly
use this issue to cause Bind to crash, resulting in a denial of service.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-19667)
It was discovered that Bind incorrectly handled large numbers of certain
invalid DNSSEC records during validation. A remote attacker could possibly
use this issue to cause Bind to use excessive resources, leading to a
denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-19668)
It was discovered that Bind incorrectly accepted inapplicable NSEC records
as proof that no wildcard existed. A remote attacker could possibly use
this issue to forge NXDOMAIN responses, masking the existence of wildcard
records. (CVE-2026-19941)
It was discovered that Bind incorrectly handled repeated copies of records
that should only appear once, such as SOA, CNAME, or DNAME records. A
remote attacker could possibly use this issue to cause Bind to use
excessive memory, leading to a denial of service. (CVE-2026-75029)
It was discovered that Bind incorrectly handled TKEY queries when the
configuration did not contain a global options block. A remote attacker
could possibly use this issue to cause Bind to crash, resulting in a denial
of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-76163)
It was discovered that Bind incorrectly accepted NSEC3 records from
unrelated sibling zones as proof of an insecure delegation. A remote
attacker could possibly use this issue to bypass DNSSEC validation and
inject forged unsigned answers. (CVE-2026-77119)
It was discovered that Bind incorrectly handled DNS-over-HTTPS requests
containing invalid SIG(0) records when the connection was closed
prematurely. A remote attacker could possibly use this issue to cause Bind
to crash, resulting in a denial of service. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-77692)
It was discovered that Bind incorrectly treated NS or DNAME records above
the zone origin as zone cuts. An attacker could possibly use this issue to
cause Bind to serve or cache out-of-zone data, resulting in cache
poisoning. (CVE-2026-78301)
It was discovered that Bind incorrectly handled wildcard answers with both
NSEC3 and NSEC proofs at the same owner name. A remote attacker could
possibly use this issue to cause Bind to crash, resulting in a denial of
service. (CVE-2026-80274)
It was discovered that Bind incorrectly released resources when processing
SVCB and HTTPS AliasMode records. A remote attacker could possibly use this
issue to cause Bind to exhaust resources, leading to a denial of service.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-81563)
It was discovered that Bind incorrectly limited additional processing for
cached SVCB and HTTPS AliasMode records. A remote attacker could possibly
use this issue to cause Bind to use excessive CPU resources, leading to a
denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81736)
5 hours 58 minutes ago
It was discovered that curl, when built with GnuTLS support, had an
out-of-bounds read in the WebSocket send path. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-107928)
Maksim discovered that curl did not correctly include the interface
binding in connection reuse decisions when CURLOPT_INTERFACE was used.
An attacker could possibly use this issue to cause connections to go
out from an unintended source address. (CVE-2026-107929)
Stanislav Fort discovered that curl did not properly clear AWS SigV4
authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-86409)
Stanislav Fort discovered that the curl command line tool did not set
SSH host verification options when following redirects to SFTP or SCP
URLs. An attacker could possibly use this issue to perform
machine-in-the-middle attacks. (CVE-2026-86410)
Stanislav Fort discovered that curl did not properly handle cookie jar
entries that could not be reloaded. An attacker could possibly use this
issue to cause a denial of service. (CVE-2026-86412)
Stanislav Fort discovered that an HTTP proxy could trick libcurl into
sending credentials to the proxy itself by responding to a CONNECT
request with an unexpected authentication challenge. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-86414)
Stanislav Fort discovered that curl did not correctly handle HSTS
entries when an includeSubDomains parent entry was imported before a
longer-lived child entry. An attacker could possibly use this issue to
cause curl to use unencrypted HTTP connections. (CVE-2026-87862)
Stanislav Fort discovered that curl did not properly handle HSTS
max-age values that exceeded calendar time structure bounds. An
attacker could possibly use this issue to cause a denial of service or
data loss. (CVE-2026-87863)
Stanislav Fort discovered that curl did not properly handle IMAP APPEND
commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be
interpreted as pipelined commands. An authenticated attacker could
possibly use this issue to inject arbitrary IMAP commands.
(CVE-2026-87864)
Bobbeh Rhino discovered that libcurl, when used with libssh2 and a
hashed known_hosts file, could misreport a host key mismatch as a
missing key. An attacker could possibly use this issue to perform
machine-in-the-middle attacks. (CVE-2026-87865)
Joshua Rogers discovered that curl did not properly handle long cookie
entries written to a Netscape cookie jar. An attacker could possibly
use this issue to cause a denial of service. (CVE-2026-92386)
Joshua Rogers discovered that a malicious FTP, IMAP, POP3, or SMTP
server could cause libcurl to block indefinitely by omitting the final
control-response line. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-92387)
Joshua Rogers discovered that libcurl had a use-after-free
vulnerability in the FTP wildcard matching code. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2026-92388)
Joshua Rogers discovered that libcurl's TFTP state machine did not
properly validate transfer directions, allowing a malicious server to
force the client into transmit mode. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2026-92389)
Joshua Rogers discovered that curl did not properly enforce its file
overwrite protection when using --remote-header-name in certain
circumstances. An attacker could possibly use this issue to overwrite
local files. (CVE-2026-92390)
Joshua Rogers discovered that curl had a stack overflow vulnerability
when processing deeply nested MIME structures. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial
of service. (CVE-2026-92391)
Joshua Rogers discovered that libcurl could expose credentials in the
URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved
from a .netrc file. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-94266)
Joshua Rogers discovered that libcurl had a use-after-free
vulnerability during HTTP/2 uploads when handling RST_STREAM responses
from the server. An attacker could possibly use this issue to cause
curl to crash, resulting in a denial of service, or execute arbitrary
code. (CVE-2026-92392)
