CVE-2026-39155 in DNS
Summary
by MITRE • 07/24/2026
Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to synthesize negative answers for legitimate names and causing resolver-side denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability identified in Knot DNS versions prior to 3.4.10 and 3.5.x versions before 3.5.4 resides within the mod-onlinesign module, which handles online signing operations for DNSSEC. This flaw specifically affects the computation of NSEC record owner names, creating a critical weakness in the DNS security infrastructure that can be exploited to manipulate negative answer processing. The issue stems from incorrect calculation of the next NSEC owner name in the zone, which directly impacts how authoritative servers generate authenticated denial intervals for non-existent domain names.
The technical flaw manifests when the mod-onlinesign module fails to properly compute the next NSEC record in the zone's ordering sequence, resulting in an overly broad authenticated denial interval. This miscalculation allows for the creation of incorrect NSEC records that can cover a larger range of domain names than intended, effectively extending the scope of negative caching beyond what should be permitted. The vulnerability operates at the intersection of DNSSEC validation and caching mechanisms, specifically targeting how downstream resolvers process authenticated denials.
From an operational perspective, this vulnerability creates a significant risk for resolver-side denial of service conditions when downstream validating resolvers employ aggressive negative caching strategies. When malicious actors or compromised systems can cause incorrect NSEC records to be cached, legitimate queries for domain names that fall within the incorrectly expanded denial interval will be incorrectly answered with synthesized negative responses. This leads to cascading failures where valid domains become unreachable due to false negative caching behavior.
The impact of this vulnerability aligns with CWE-248, which addresses exposure of unintended information through error messages, and follows patterns similar to those described in ATT&CK technique T1566 related to credential access through network manipulation. The flaw essentially allows for the manipulation of DNSSEC validation processes, potentially enabling attackers to disrupt legitimate DNS resolution while maintaining the appearance of normal operation. This makes detection particularly challenging as the malicious behavior occurs within what appears to be legitimate DNSSEC processing.
Effective mitigation strategies include immediate deployment of patched versions of Knot DNS 3.4.10 or 3.5.4, which contain corrected NSEC owner name computation logic. Organizations should also implement monitoring for unusual negative caching patterns and consider temporarily disabling aggressive negative caching on affected resolvers until patches are deployed. Network administrators should verify DNSSEC configurations post-patch to ensure proper NSEC record generation and validate that denial intervals correctly reflect zone boundaries. Additionally, implementing proper access controls and network segmentation can limit the impact if exploitation occurs, while regular security assessments of DNS infrastructure help identify similar vulnerabilities in other components of the DNS ecosystem.