# NLnet Labs vulnerabilities Source: https://junglewise.ai/threats/vendors/nlnet-labs Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/nlnet-labs.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 66 vulnerabilities in NLnet Labs: 0 in the last 7 days and 24 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-109142, was published on 2 November 2026. 17 vulnerabilities in the last four weeks, up 143% on the four before (7). 0 critical against 2. 4 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 17 - Last 90 days: 24 - All time: 66 (2 critical, 0 exploited in the wild) ## About NLnet Labs NLnet Labs is a non-profit foundation that develops open-source software and protocols for the core of the Internet. ## Latest NLnet Labs vulnerabilities - [CVE-2026-109142: NLnet Labs Krill parent CA authentication bypass](https://junglewise.ai/threats/cve-2026-109142-when-a-ca-s-parent-lives-on-the-same-krill-server-instead-of) (high, CVSS 8.4, published 2 Nov 2026) - [CVE-2026-109141: Krill authorization bypass in bulk CA import](https://junglewise.ai/threats/cve-2026-109141-the-vulnerability-gives-a-role-that-is-restricted-to-a-list-of) (high, CVSS 8.4, published 2 Nov 2026) - [CVE-2026-109140: NLnet Labs Krill session token forgery via nonce reuse](https://junglewise.ai/threats/cve-2026-109140-the-vulnerability-is-that-krill-encrypts-every-login-session) (high, CVSS 8.4, published 2 Nov 2026) - [CVE-2026-72758: Routinator AS range parsing memory exhaustion](https://junglewise.ai/threats/cve-2026-72758-when-parsing-an-as-range-in-routinator-if-the-maximum-value-of) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-72757: Routinator HTTP server denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-72757-routinator-runs-out-of-open-connections-on-the-http-server-when) (medium, CVSS 5.3, published 26 Oct 2026) - [CVE-2026-72756: Routinator denial of service from malformed rsync URIs](https://junglewise.ai/threats/cve-2026-72756-routinator-exits-when-an-rsync-uri-for-a-file-obtained-over-rrdp) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-72754: Routinator CRL parsing denial of service](https://junglewise.ai/threats/cve-2026-72754-when-routinator-encounters-a-crl-with-many-entries-it-may-hang-or) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-72753: Routinator improper RRDP delta entry validation](https://junglewise.ai/threats/cve-2026-72753-when-routinator-encounters-an-rrdp-notification-file-with-gaps-in) (high, CVSS 8.2, published 26 Oct 2026) - [CVE-2026-72752: NLnet Labs Routinator denial of service via repeated JSON requests](https://junglewise.ai/threats/cve-2026-72752-routinator-runs-out-of-memory-when-the-json-output-is-requested) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-97206: NLnet Labs Unbound use-after-free in DNS-over-QUIC stream cleanup](https://junglewise.ai/threats/cve-2026-97206-nlnet-labs-unbound-1-22-0-up-to-and-including-version-1-26-1) (high, CVSS 7.5, published 21 Oct 2026) - [CVE-2026-96405: NLnet Labs Unbound DNS decompression CPU exhaustion](https://junglewise.ai/threats/cve-2026-96405-nlnet-labs-unbound-up-to-and-including-version-1-26-1-limits) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-50106: NLnet Labs Unbound DNS validator bypass in DNSSEC validation](https://junglewise.ai/threats/cve-2026-50106-when-nlnet-labs-unbound-up-to-and-including-version-1-26-1-is) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-109125: NLnet Labs Unbound cache side-channel in upstream source port probe](https://junglewise.ai/threats/cve-2026-109125-in-nlnet-labs-unbound-up-to-and-including-version-1-26-1-an) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-101341: NSD stack buffer overflow in RDATA parsing](https://junglewise.ai/threats/cve-2026-101341-tokens-of-text-in-rdata-of-for-example-txt-records-under-32) (info, published 14 Oct 2026) - [CVE-2026-101339: NSD stack overflow in HIP resource record parsing](https://junglewise.ai/threats/cve-2026-101339-a-hip-resource-record-that-fills-the-rdata-near-or-at-is-limit) (info, published 14 Oct 2026) - [CVE-2026-101338: NSD stack buffer overflow in SVCB/HTTPS record parsing](https://junglewise.ai/threats/cve-2026-101338-when-a-svcb-or-https-rr-has-filled-the-wire-format-rdata-up-to) (info, published 14 Oct 2026) - [CVE-2026-101337: NSD stack buffer overflow in base64 RDATA parsing](https://junglewise.ai/threats/cve-2026-101337-when-base64-data-is-split-up-in-pieces-of-3-character-or-less) (info, published 14 Oct 2026) - [CVE-2026-85501: NLnet Labs Unbound DNS complexity attacks via ReTrap](https://junglewise.ai/threats/cve-2026-85501-nlnet-labs-unbound-dns-complexity-attacks-via-retrap) (medium, CVSS 5.3, published 16 Sep 2026) - [CVE-2026-82720: NLnet Labs Unbound use-after-free in DNS-over-HTTPs](https://junglewise.ai/threats/cve-2026-82720-nlnet-labs-unbound-use-after-free-in-dns-over-https) (medium, CVSS 5.9, published 16 Sep 2026) - [CVE-2026-82717: NLnet Labs Unbound heap buffer overflow in CNAME synthesis](https://junglewise.ai/threats/cve-2026-82717-nlnet-labs-unbound-heap-buffer-overflow-in-cname-synthesis) (critical, CVSS 9.8, published 16 Sep 2026) - [CVE-2026-81642: NLnet Labs Unbound DNSSEC validator buffer overflow](https://junglewise.ai/threats/cve-2026-81642-nlnet-labs-unbound-dnssec-validator-buffer-overflow) (critical, CVSS 9.8, published 16 Sep 2026) - [CVE-2026-81634: NLnet Labs Unbound heap buffer overflow in RRSet canonicalisation](https://junglewise.ai/threats/cve-2026-81634-nlnet-labs-unbound-heap-buffer-overflow-in-rrset-canonicalisation) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-78227: NLnet Labs Unbound use-after-free in DNS-over-QUIC](https://junglewise.ai/threats/cve-2026-78227-nlnet-labs-unbound-use-after-free-in-dns-over-quic) (medium, CVSS 6.5, published 16 Sep 2026) - [CVE-2026-77955: NLnet Labs Unbound ZONEMD check bypass in delegated zones](https://junglewise.ai/threats/cve-2026-77955-nlnet-labs-unbound-zonemd-check-bypass-in-delegated-zones) (medium, CVSS 4.4, published 16 Sep 2026) - [CVE-2026-56444: NLnet Labs Unbound resource exhaustion in serve-expired logic](https://junglewise.ai/threats/cve-2026-56444-nlnet-labs-unbound-resource-exhaustion-in-serve-expired-logic) (medium, CVSS 5.9, published 22 Jul 2026) ## Most severe NLnet Labs vulnerabilities - [CVE-2026-81642: NLnet Labs Unbound DNSSEC validator buffer overflow](https://junglewise.ai/threats/cve-2026-81642-nlnet-labs-unbound-dnssec-validator-buffer-overflow) (critical, CVSS 9.8, published 16 Sep 2026) - [CVE-2026-82717: NLnet Labs Unbound heap buffer overflow in CNAME synthesis](https://junglewise.ai/threats/cve-2026-82717-nlnet-labs-unbound-heap-buffer-overflow-in-cname-synthesis) (critical, CVSS 9.8, published 16 Sep 2026) - [CVE-2026-109142: NLnet Labs Krill parent CA authentication bypass](https://junglewise.ai/threats/cve-2026-109142-when-a-ca-s-parent-lives-on-the-same-krill-server-instead-of) (high, CVSS 8.4, published 2 Nov 2026) - [CVE-2026-109141: Krill authorization bypass in bulk CA import](https://junglewise.ai/threats/cve-2026-109141-the-vulnerability-gives-a-role-that-is-restricted-to-a-list-of) (high, CVSS 8.4, published 2 Nov 2026) - [CVE-2026-109140: NLnet Labs Krill session token forgery via nonce reuse](https://junglewise.ai/threats/cve-2026-109140-the-vulnerability-is-that-krill-encrypts-every-login-session) (high, CVSS 8.4, published 2 Nov 2026) - [CVE-2026-72753: Routinator improper RRDP delta entry validation](https://junglewise.ai/threats/cve-2026-72753-when-routinator-encounters-an-rrdp-notification-file-with-gaps-in) (high, CVSS 8.2, published 26 Oct 2026) - [CVE-2026-81634: NLnet Labs Unbound heap buffer overflow in RRSet canonicalisation](https://junglewise.ai/threats/cve-2026-81634-nlnet-labs-unbound-heap-buffer-overflow-in-rrset-canonicalisation) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-49234: NLnet Labs Routinator denial of service via malformed ASN query parameter](https://junglewise.ai/threats/cve-2026-49234-nlnet-labs-routinator-denial-of-service-via-malformed-asn-query) (high, CVSS 7.5, published 8 Jun 2026) - [CVE-2026-72758: Routinator AS range parsing memory exhaustion](https://junglewise.ai/threats/cve-2026-72758-when-parsing-an-as-range-in-routinator-if-the-maximum-value-of) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-72756: Routinator denial of service from malformed rsync URIs](https://junglewise.ai/threats/cve-2026-72756-routinator-exits-when-an-rsync-uri-for-a-file-obtained-over-rrdp) (high, CVSS 7.5, published 26 Oct 2026) ## Vulnerabilities per week 17 vulnerabilities in the last four weeks, up 143% on the four before (7). 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 7 | 2 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 6 | 0 | 0 | | 2 Nov 2026 | 3 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## NLnet Labs technologies - [NLnet Labs Unbound](https://junglewise.ai/threats/technologies/unbound): 46 vulnerabilities - [NLnet Labs Routinator](https://junglewise.ai/threats/technologies/routinator): 10 vulnerabilities - [NLnet Labs NSD](https://junglewise.ai/threats/technologies/nlnet-labs-nsd): 4 vulnerabilities - [NLnet Labs Krill](https://junglewise.ai/threats/technologies/krill): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "NLnet Labs vulnerabilities", https://junglewise.ai/threats/vendors/nlnet-labs, 10 November 2026.