Qifan Zhang (Palo Alto Networks)

Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

BOGUS configured primary hostname accepted for XFR in auth/rpz zones

'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path

Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

Packet of death for DNSCrypt over TCP

Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records