This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-39155 →

DEBIAN-CVE-2026-39155

Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. T...

Original description

The description as published by the source.

Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to synthesize negative answers for legitimate names and causing resolver-side denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 knot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 knot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 knot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-1"}]}]

References

advisory security-tracker.debian.org