Public Exploit Code Released for Knot Resolver DNS-over-QUIC Remote Code Execution Flaw
Do Son 
TL;DR
A researcher published full technical details and working proof-of-concept exploit code for a Knot Resolver RCE bug. The heap out-of-bounds write sits in the DNS-over-QUIC listener and needs no authentication. CZ.NIC shipped the fix a day earlier in version 6.4.1.
Why it matters
Knot Resolver is CZ.NIC’s open-source caching recursive resolver. Large ISPs run it in front of very large subscriber bases. Code execution on a resolver lets an attacker forge DNS answers for every downstream client.
The daemon, kresd, takes untrusted input straight off the network. That makes this Knot Resolver RCE reachable by anyone who can hit the DoQ port. No credentials are required, and one QUIC connection is enough.
How the attack works
At heart this is a size-tracking error, classified as CWE-787. kresd reassembles inbound DoQ STREAM frames into a per-connection input buffer. The receive callback adds each frame’s length to the tracked size instead of resetting that size to the new total.
Across several frames, the tracked size drifts above the real allocation. A later frame then slips under that inflated figure and skips the reallocation. The copy that follows runs past the end of the object. Because the allocator pins the object to its true size class, the spilled bytes land in the neighbouring slab slot.
Light connection grooming arranges for that neighbour to hold a TLS library cleanup object. Overwriting a function pointer inside it hands the attacker control of the instruction pointer during connection teardown. A failed attempt merely crashes the worker, which the supervisor respawns, so attackers can retry.
Exploitation status
No exploitation in the wild has been confirmed. A public proof-of-concept does exist, however. The published PoC and technical write-up demonstrate end-to-end remote code execution against a lab host with ASLR switched off. With ASLR enabled, the same primitive would still need an information leak.
Affected versions
Knot Resolver 6.3.0 is affected, verified on the 6.3.0-cznic.1 build under Debian 12. Version 6.4.1, released 22 July 2026, contains the fix. No CVE identifier has been published at the time of writing.
The researcher reported the bug to CZ.NIC on 8 June 2026 and held the write-up until the patch landed.
What to do
- Upgrade to Knot Resolver 6.4.1 without delay
- Disable the DoQ listener if you cannot patch today
- Restrict the DoQ port to trusted clients at the firewall
- Alert on repeated kresd worker crashes, which signal failed attempts
DoT and DoH deployments are not the affected path here. Still, any resolver exposing DoQ to the internet should treat this as urgent.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
