Nlnetlabs Ldns — known CVE vulnerabilities

Every CVE whose affected-product data names Nlnetlabs Ldns, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (8)

• CVE-2017-1000231 — CVSS 9.8 (critical): A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.
• CVE-2017-1000232 — CVSS 9.8 (critical): A double-free vulnerability in str2host.c in ldns 1.7.0 have unspecified impact and attack vectors.
• CVE-2026-10846 — CVSS 7.5 (high): NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query…
• CVE-2020-19861 — CVSS 7.5 (high): When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone…
• CVE-2011-3581 — CVSS 6.8 (medium): Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns before 1.6.11 allows remote attackers to cause a denial of…
• CVE-2020-19860 — CVSS 6.5 (medium): When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An…
• CVE-2009-1086 — CVSS 6.4 (medium): Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns 1.4.x allows remote attackers to cause a denial of service…
• CVE-2014-3209 — CVSS 2.1 (low): The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain…