DNS resolver vulnerabilities

Vulnerability in DNSSEC validation allows bypassing signature verification for wildcard expansion proofs (NSEC/NSEC3) when the answer is a CNAME or DNAME record.

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

A rogue backend can send a crafted UDP response with a query ID off by one relative to the maximum configured value, triggering an out-of-bounds write that leads to denial of service.