Knot Resolver 6.3.0 DoQ overflow allows unauthenticated RCE

A remotely triggerable heap buffer overflow in Knot Resolver 6.3.0's DNS-over-QUIC (DoQ) receive path can lead to remote code execution with no authentication. The issue was reported to CZ.NIC and fixed in Knot Resolver 6.4.1, released 2026-07-22.

Knot Resolver is an open-source caching DNS recursive resolver from CZ.NIC, widely used in large ISP environments, and it supports encrypted transports including DoQ. Security researcher Przemyslaw Frasunek found that the DoQ listener reassembles inbound STREAM frames into a per-connection input buffer but grows the tracked buffer size by repeatedly adding each frame's length instead of recording the true total. Across several frames that tracked size drifts above the real allocation. A later frame whose length still appears to fit under the inflated size skips reallocation, and the following copy writes past the end of the object into adjacent heap memory.

Frasunek showed that one unauthenticated QUIC connection carrying a short sequence of STREAM frames is enough to drive a controlled out-of-bounds write. Impact is remote code execution as the knot-resolver user, or at minimum remote denial of service. Affected builds include 6.3.0 as verified on Debian 12; operators running DoQ on that release should upgrade to 6.4.1.