CVE-2026-39155 | Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vul… | CVSS 6.5 MEDIUM

Description

Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to synthesize negative answers for legitimate names and causing resolver-side denial of service.

Metadata

CVE ID: CVE-2026-39155
State: PUBLISHED
Assigner: mitre
Reserved: 2026-04-06 00:00 UTC
Published: 2026-07-23 00:00 UTC
Last updated: 2026-07-24 19:35 UTC
Primary CWE: CWE-345
CWE-345 Insufficient Verification of Data Authenticity
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-345	adp	CWE-345 Insufficient Verification of Data Authenticity

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References (2)