Executive brief
Knot Resolver is a popular tool used by internet service providers and large organizations to translate website names into IP addresses. A security flaw in its handling of encrypted DNS-over-QUIC traffic allows an attacker to potentially take control of the server or crash the service. This could lead to internet connectivity outages for users or allow an attacker to gain a foothold in a corporate network.
Technical details
A heap-based buffer overflow exists in the Knot Resolver (kresd) DoQ receive path within 'daemon/quic_conn.c'. The root cause is improper validation of specified quantities in input (CWE-1284) where the 'kr_recv_stream_data_cb' function incorrectly calculates the tracked size of the input buffer during reassembly of STREAM frames. This size drift allows a subsequent frame to bypass reallocation checks, leading to an out-of-bounds write (CWE-787) into adjacent heap slots. An unauthenticated remote attacker can exploit this to overwrite function pointers in memory (specifically within libgnutls cleanup handlers), achieving remote code execution as the 'knot-resolver' user. The vulnerability is fixed in version 6.4.1.
Affected products
- CZ.NIC Knot Resolver before 6.4.1
Timeline
- 2026-06-08: disclosed: Reported to vendor (CZ.NIC)
- 2026-07-22: patched: Fixed in version 6.4.1
- 2026-07-23: advisory: Public disclosure and PoC released
- 2026-07-25: other: CVE published to NVD