Bug 2506619 (CVE-2026-39155)

Summary: CVE-2026-39155 knot-dns: knot: Knot DNS: Denial of Service due to incorrect NSEC owner name computation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Knot DNS. The mod-onlinesign component incorrectly computes the next NSEC (Next Secure) owner name. This can lead to an overly broad authenticated denial interval, allowing DNS (Domain Name System) resolvers that use aggressive negative caching to incorrectly generate negative responses for valid domain names. This ultimately results in a denial of service for legitimate DNS queries.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2520878, 2520879    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-23 21:01:19 UTC
Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to synthesize negative answers for legitimate names and causing resolver-side denial of service.