CVE-2026-39155

MEDIUM

Knot DNS <3.4.10, 3.5.x<3.5.4: Authenticated DoS via NSEC Owner Name Miscalculation in mod-onlinesign

Title source: llm

Description

Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to synthesize negative answers for legitimate names and causing resolver-side denial of service.

References (2)

Core 2

Core References

https://www.knot-dns.cz/2026-04-01-version-3410.html

https://www.knot-dns.cz/2026-04-02-version-354.html

Scores

CVSS v3 6.5

EPSS 0.0015

EPSS Percentile 4.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-345

Status published

Published Jul 23, 2026

Tracked Since Jul 24, 2026