Nic vulnerabilities
20 vulnerabilities
Known vulnerabilities in Nic products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4- Knot Resolver15 vulnerabilities
- BIRD3 vulnerabilities
- Foris1 vulnerabilities
- Knot Cms1 vulnerabilities
CVE-2026-112112nicbirdAn IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.CVE-2018-1110debianknot-resolver+2
EPSS score1.24%
A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service.CVE-2018-1000002debianknot-resolver+1EPSS score1.08%
Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.CVE-2018-10920cz.nicknot-resolver+3EPSS score3.24%
Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.CVE-2013-5661iscbind+3EPSS score3.45%
Cache Poisoning issue exists in DNS Response Rate Limiting.CVE-2021-40083debianknot-resolver+2EPSS score1.42%
Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a remote attacker in an edge case (NSEC3 with too many iterations used for a positive wildcard proof).CVE-2021-26928nicbirdEPSS score1.01%
BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which may, for example, include Tigera products in some configurations, as well as products of other vendors) may have been susceptible to route redirection for Denial of Service and/or Information Disclosure. NOTE: a researcher has asserted that the behavior is within Tigera’s area of responsibility; however, Tigera disagreesCVE-2021-3346nicforisEPSS score1.59%
Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template.CVE-2020-12667debianknot-resolver+2EPSS score2.61%
Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.CVE-2014-0486debianknot+1EPSS score3.33%
Knot DNS before 1.5.2 allows remote attackers to cause a denial of service (application crash) via a crafted DNS message.CVE-2022-40188debianknot-resolver+4EPSS score1.95%
Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an authoritative server must return large NS sets or address sets.CVE-2022-32983debianknot-resolver+2EPSS score0.74%
Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filters.CVE-2019-16159debianbird+9EPSS score3.15%
BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed.CVE-2019-19331cz.nicknot-resolver+4EPSS score2.11%
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).CVE-2019-10190cz.nicknot-resolver+4EPSS score1.99%
A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of sending a SERVFAIL packet. Caching is not affected by this particular bug but see CVE-2019-10191.CVE-2019-10191cz.nicknot-resolver+4EPSS score1.93%
A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.CVE-2026-66374debianknot-resolver+2EPSS score0.62%
Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.CVE-2026-49943debianbird+6EPSS score0.40%
CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as "bgp_path ~ [= ... =]", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.CVE-2023-26249debianknot-resolver+2EPSS score0.71%
Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specifically, a single client query may lead to a hundred TCP connection attempts if a DNS server closes connections without providing a response.CVE-2023-46317debianknot-resolver+2EPSS score0.64%
Knot Resolver before 5.7.0 performs many TCP reconnections upon receiving certain nonsensical responses from servers.