Heap-based Buffer Overflow in Knot Resolver

Executive Summary

CVE-2026-66374 is a heap-based buffer overflow in Knot Resolver's DNS-over-QUIC (DoQ) receive path. It allows remote code execution due to incorrect buffer size tracking during the reassembly of inbound DoQ STREAM frames. An attacker can send a crafted QUIC connection with multiple STREAM frames to trigger a heap out-of-bounds write, potentially overwriting memory and enabling code execution as the knot-resolver user.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of Knot Resolver running on your system. Run: knotd --version. If the version is below 6.4.1, the system is vulnerable. Additionally, monitor network traffic for DoQ (DNS-over-QUIC) connections, especially those sending multiple STREAM frames in a single QUIC connection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to execute arbitrary code on systems running vulnerable Knot Resolver versions. Successful exploitation could lead to full system compromise, data theft, or service disruption. The attack requires only a single QUIC connection and works without requiring information leaks if ASLR is disabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using vulnerable Knot Resolver versions may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Knot Resolver to version 6.4.1 or later. If upgrading is not possible, disable the DoQ (DNS-over-QUIC) listener in the Knot Resolver configuration to prevent exploitation. Restrict network access to the DoQ port (typically 853/udp) if DoQ is not required.

Useful 0 Not Useful 0