THE article discusses a critical vulnerability (CVE-2026-16232) in Knot Resolver, which is an open-source caching recursive resolver used by large ISPs. The vulnerability involves improper authentication and allows remote code execution (RCE) due to a heap overflow in the DNS-over-QUIC (DoQ) listener, requiring no authentication. The issue arises from incorrect size tracking during frame processing, allowing attackers to overwrite function pointers and gain control of the instruction pointer.
A proof-of-concept (PoC) exploit code is publicly available, although no confirmed exploitation has occurred in the wild. It is critical for users to upgrade to Knot Resolver version 6.4.1, released on July 22, 2026, to mitigate this risk. Furthermore, users should consider disabling the DoQ listener or restricting access to trusted clients in the meantime.