Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 226–250 of 320
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-123587 | HIGH | Patched | 6.8 | 2026-11-08 | The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the… |
| CVE-2026-123586 | HIGH | 7.5 | 2026-11-08 | Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that… | |
| CVE-2026-123585 | MEDIUM | Patched | 5.3 | 2026-11-08 | The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary t… |
| CVE-2026-123584 | HIGH | Patched | 5.9 | 2026-11-08 | The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a D… |
| CVE-2026-123583 | MEDIUM | Patched | 3.7 | 2026-11-08 | The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative… |
| CVE-2026-123582 | MEDIUM | Patched | 3.7 | 2026-11-08 | The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation… |
| CVE-2026-123581 | MEDIUM | Patched | 5.3 | 2026-11-08 | Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer w… |
| CVE-2026-123580 | HIGH | Patched | 7.5 | 2026-11-08 | Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, c… |
| CVE-2026-123579 | MEDIUM | Patched | 3.7 | 2026-11-08 | DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expand… |
| CVE-2026-123578 | MEDIUM | Patched | 3.7 | 2026-11-08 | Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the respon… |
| CVE-2026-123577 | HIGH | Patched | 7.5 | 2026-11-08 | Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. A… |
| CVE-2026-123576 | HIGH | 7.5 | 2026-11-08 | Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC re… | |
| CVE-2026-123575 | HIGH | Patched | 7.5 | 2026-11-08 | Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request b… |
| CVE-2026-123574 | HIGH | Patched | 7.5 | 2026-11-08 | The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can sup… |
| CVE-2026-123573 | HIGH | Patched | 7.5 | 2026-11-08 | hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply… |
| CVE-2026-123572 | HIGH | Patched | 7.5 | 2026-11-08 | Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malf… |
| CVE-2026-123571 | HIGH | Patched | 7.5 | 2026-11-08 | Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed recor… |
| CVE-2026-123570 | HIGH | Patched | 7.5 | 2026-11-08 | The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header… |
| CVE-2026-123569 | HIGH | Patched | 7.5 | 2026-11-08 | The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a spar… |
| CVE-2026-123568 | LOW | Patched | 4.4 | 2026-11-08 | Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the … |
| CVE-2026-123567 | MEDIUM | Patched | 3.7 | 2026-11-08 | Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse a… |
| CVE-2026-123566 | HIGH | Patched | 7.5 | 2026-11-08 | Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers wh… |
| CVE-2026-123565 | HIGH | Patched | 7.5 | 2026-11-08 | Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can … |
| CVE-2026-123564 | HIGH | Patched | 7.5 | 2026-11-08 | Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's de… |
| CVE-2026-123563 | HIGH | Patched | 7.5 | 2026-11-08 | Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attacke… |