Executive brief
Knot DNS, a high-performance authoritative DNS server, contains a flaw in its online signing module. This vulnerability can cause the server to provide incorrect security records that tell other internet services that legitimate websites do not exist. This results in a denial of service where users are unable to reach valid websites because their DNS lookups are being incorrectly blocked by cached negative responses.
Technical details
A logic error exists in the 'mod-onlinesign' module of Knot DNS where the 'next NSEC owner name' is computed incorrectly during online DNSSEC signing. This results in the generation of an overly broad authenticated denial interval. Downstream validating resolvers that utilize aggressive negative caching (RFC 8198) will ingest these NSEC records and may synthesize negative answers for legitimate, existing domain names within the broad interval. This effectively causes a distributed denial of service (DoS) at the resolver level for any valid names caught in the incorrect NSEC range. The issue is resolved in versions 3.4.10 and 3.5.4.
Affected products
- CZ.NIC Knot DNS before 3.4.10, 3.5.x before 3.5.4
Timeline
- 2026-04-01: patched: Version 3.4.10 released
- 2026-04-02: patched: Version 3.5.4 released
- 2026-07-23: disclosed: CVE published