CVE-2026-46600
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Risk Assessment
Risk involves potential panic (crash) when processing specially crafted DNS records, leading to denial of service (DoS).
Recommendation
Apply patches provided by the software vendor that fix handling of SVCB and HTTPS RR records.
Other vulnerabilities in DNS resolver
See all- CVE-2026-52686Low
Vulnerability in DNSSEC validation allows bypassing signature verification for wildcard expansion proofs (NSEC/NSEC3) when the answer is a CNAME or DNAME record.
- CVE-2026-33602Medium
A rogue backend can send a crafted UDP response with a query ID off by one relative to the maximum configured value, triggering an out-of-bounds write that leads to denial of service.
Original NVD description (English source)
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS