Heap overflow bug in Knot Resolver lets attackers run code

The article discusses a critical vulnerability (CVE-2026-16232) in Knot Resolver, which is an open-source caching recursive resolver used by large ISPs. The vulnerability involves improper authentication and allows remote code execution (RCE) due to a heap overflow in the DNS-over-QUIC (DoQ) listener, requiring no authentication. The issue arises from incorrect size tracking during frame processing, allowing attackers to overwrite function pointers and gain control of the instruction pointer.

A proof-of-concept (PoC) exploit code is publicly available, although no confirmed exploitation has occurred in the wild. It is critical for users to upgrade to Knot Resolver version 6.4.1, released on July 22, 2026, to mitigate this risk. Furthermore, users should consider disabling the DoQ listener or restricting access to trusted clients in the meantime.

CVE-2026-16232 coverage
Published (UTC)	Outlet	Headline
Wed 22 Jul · 19:08 UTC	SecurityOnline	Check Point SmartConsole flaw CVE-2026-16232 under active attack
Wed 22 Jul · 20:20 UTC	CISA	CISA Flags Active Exploitation of Check Point SmartConsole Flaw
Wed 22 Jul · 22:02 UTC	CISA	CISA flags Check Point SmartConsole flaw in latest KEV update
Thu 23 Jul · 04:06 UTC	SecurityOnline	GitHub Actions Abused to Steal Credentials from PHP Packages
Thu 23 Jul · 04:07 UTC	SecurityOnline	Two Active BIND Exploits Highlighted as Nine Flaws Patched
Thu 23 Jul · 09:09 UTC	SecurityWeek	Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass
Thu 23 Jul · 09:45 UTC	Security Affairs	Check Point fixes critical SmartConsole auth bypass exploited now
Thu 23 Jul · 13:10 UTC	Rapid7	CVE-2026-16232 flaw lets hackers access Check Point admin
Thu 23 Jul · 21:01 UTC	Security Affairs	U.S. CISA adds Microsoft SharePoint and Check Point SmartConsole flaws to its Known Exploited Vulnerabilities catalog
Fri 24 Jul · 03:10 UTC	SecurityOnline	Heap overflow bug in Knot Resolver lets attackers run code (this article)
Mon 27 Jul · 02:21 UTC	SecurityOnline	UK firms must patch now as CISA flags six active exploits
Wed 29 Jul · 08:13 UTC	SecurityOnline	Check Point SmartConsole Authentication Bypass CVE-2026-16232 Exploited as Zero-Day, PoC and Details Public

CVE-2026-16232 coverage

Published (UTC)

Outlet

Headline

Wed 22 Jul · 19:08 UTC

SecurityOnline

Check Point SmartConsole flaw CVE-2026-16232 under active attack

Wed 22 Jul · 20:20 UTC

CISA

CISA Flags Active Exploitation of Check Point SmartConsole Flaw

Wed 22 Jul · 22:02 UTC

CISA