CVE-2026-66374: Knot Resolver DoQ RCE Vulnerability

CVE-2026-66374 Overview

CVE-2026-66374 is a heap-based buffer overflow in Knot Resolver versions prior to 6.4.1. The flaw resides in the DNS-over-QUIC (DoQ) receive path and can lead to remote code execution. An unauthenticated remote attacker can trigger the overflow by sending crafted DoQ traffic to a vulnerable resolver. Successful exploitation compromises the integrity of the resolver process and can pivot to broader impact on the resolution infrastructure. The issue is tracked under [CWE-1284] (improper validation of specified quantity in input) and affects the DoQ transport handler specifically, not the classic UDP or TCP DNS paths.

Critical Impact
Unauthenticated remote code execution against Knot Resolver instances exposing DoQ, with potential downstream impact on DNS resolution for all clients served by the resolver.

Affected Products

Knot Resolver versions prior to 6.4.1
Deployments exposing the DNS-over-QUIC (DoQ) listener
Recursive DNS infrastructure built on Knot Resolver

Discovery Timeline

2026-07-25 - CVE-2026-66374 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66374

Vulnerability Analysis

The vulnerability affects the DoQ receive path within Knot Resolver. DoQ transports DNS messages over QUIC streams as defined in RFC 9250. When the resolver parses inbound QUIC stream data carrying DNS messages, a length field is not properly validated against the destination heap buffer size. An attacker who sends a crafted QUIC stream can write beyond the allocated buffer boundary and corrupt adjacent heap memory. The attack requires no authentication and no user interaction, but exploitation complexity is elevated because it depends on QUIC session establishment and precise heap layout manipulation. Refer to the Openwall OSS Security Post and the GitHub PoC Repository for further technical details.

Root Cause

The root cause is improper validation of a size or count field in the DoQ receive handler. The parser trusts an attacker-controlled quantity when copying DNS message bytes into a heap-allocated buffer. Because the check does not enforce the actual buffer capacity, a larger-than-expected value produces an out-of-bounds heap write.

Attack Vector

The attack vector is network-based over UDP port 853 (DoQ). An attacker establishes a QUIC connection to the resolver and sends a crafted DNS message over a QUIC stream. The malformed payload triggers the heap overflow inside the resolver process. Public proof-of-concept material is available in the GitHub PoC Repository.

A working exploit is described in the referenced PoC repository. See the GitHub PoC Repository for the reproducer and packet construction details.

Detection Methods for CVE-2026-66374

Indicators of Compromise

Unexpected crashes, restarts, or SIGSEGV signals from the kresd process
Anomalous QUIC traffic to UDP port 853 from untrusted sources, especially with oversized DNS message frames
Child processes spawned by kresd that do not match normal operational patterns
Outbound connections from the resolver host to unfamiliar external endpoints following DoQ traffic spikes

Detection Strategies

Inspect QUIC/DoQ flows for malformed DNS messages and abnormally large length fields on port 853
Monitor process telemetry on resolver hosts for kresd termination, core dumps, or memory faults
Correlate DoQ session establishment with subsequent process anomalies or new outbound connections
Alert on shellcode-like behavior originating from the resolver user context, such as shell spawning or arbitrary binary execution

Monitoring Recommendations

Enable verbose logging on the Knot Resolver DoQ listener and forward logs to a centralized platform
Capture packet metadata for UDP/853 traffic and retain samples for retrospective analysis
Track version and patch status of all Knot Resolver instances in inventory
Baseline normal DoQ query rates and alert on sudden deviations or bursts from single sources

How to Mitigate CVE-2026-66374

Immediate Actions Required

Upgrade Knot Resolver to version 6.4.1 or later on all instances
If patching is not immediately possible, disable the DoQ listener until the upgrade is completed
Restrict inbound UDP/853 access to trusted client networks via firewall rules
Audit resolver hosts for signs of compromise, including unexpected kresd crashes and suspicious child processes

Patch Information

The vendor fix is delivered in Knot Resolver 6.4.1. Operators should install the updated package from their distribution or the upstream release channel and restart the kresd service. Review the Openwall OSS Security Post for advisory details.

Workarounds

Disable the DoQ protocol handler in the resolver configuration until the patched version is deployed
Remove or comment out any net.listen(..., { kind = 'doq' }) directives in the Knot Resolver configuration
Front the resolver with a network filter that blocks untrusted sources from reaching UDP/853
Segment the resolver into a restricted VLAN with egress filtering to limit post-exploitation movement

bash

# Example: disable DoQ listener in /etc/knot-resolver/kresd.conf
# Comment out or remove any DoQ listen directive:
# net.listen('0.0.0.0', 853, { kind = 'doq' })

# Block untrusted DoQ traffic at the host firewall (nftables example)
nft add rule inet filter input udp dport 853 ip saddr != { 10.0.0.0/8, 192.168.0.0/16 } drop

# Restart the resolver after applying the patched package
sudo systemctl restart kresd@1.service