Announcement date: October 28, 2025
What's new
WCAG AA compliance
- Text resizing to +400%
- Keyboard shortcuts
- Consistent navigation
- Color contrast
- Icons have alternative text
DNS activity filter and SIEM enhancements
- DNS resolver service: Sets the data filter for the specified DNS resolver service that the query passed through.
- GSLB rule: Sets the data filter for a
specified GSLB rule. When the filter is enabled, select one of the
following GSLB rule filter options:
- All queries: Sets the data filter to display all queries, regardless of GSLB rule.
- Queries matching any rule: Sets the data filter to display all queries that matched any GSLB rule.
- Queries matching specific rules: Sets the data filter to display queries that matched against specified GSLB rules. When selected, enter the GSLB rule names that you would like to display matching queries for.
- DNS resolver service ID: The ID of the DNS resolver service that the query passed through
- Namespace ID: The ID of the namespace that the query passed through
- Protocol: The protocol (TCP/UDP) that the query uses.
- Answer TTL: The TTL of the query answer.
Visibility into Edge licensing and entitlements
Starting in BlueCat Edge 25.3, you can now view your BlueCat Edge licensing subscriptions and entitlements. The BlueCat Edge dashboard has been updated to include the license tile, indicating whether you have an active BlueCat Edge license. Additionally, you can navigate to the page to view your currently active Edge licenses and entitlements, including the purchase date and expiration date of those licenses. You can also view additional license packages and storage options.
What's new
Support for provisioning Service Point on ESXi 8
Service Point v25.3 introduces additional support for provisioning the Service Point on ESXi versions 8.0, 8.0 Update 1, 8.0 Update 2, and 8.0 Update 3.
Custom docker and nomad network configurations
Previously, the Service Point docker and nomad network configurations had two hard coded networks for internal service communication and orchestration, resulting in problems in customer environments where IP addresses and networks overlapped with those hard-coded networks. Service Point v25.3 introduces the ability to configure custom internal networks used by docker and nomad services for internal communication and orchestration.
Resolved issues
Misconfigured service could allow arbitrary code execution
Previously, the Service Point contained a vulnerability that could allow arbitrary code execution via script checks. This issue has been resolved.
What's new
Support for multiple recursive namespace configurations
DNS Resolver Service v25.3 introduces support for multiple recursive namespaces. When configuring a site, you can now enter multiple recursive namespace within the Namespaces field for the DNS resolver service to consume.
Support for custom TTL of GSLB responses
DNS Resolver Service v25.3 introduces the ability to configure custom TTL values for responses that matched a GSLB rule. When configuring a site, the new Additional GSLB settings field where you can select the Set TTL for DNS response check box to set a maximum TTL for DNS responses sent to clients for queries that match a GSLB rule. If you select this check box, enter a custom TTL value in the DNS record TTL field, in seconds.
Support for custom SOA records for queries modified by a policy
- Authority zone: The FQDN of the DNS zone for which the SOA record is authoritative.
- Primary name server (MNAME): The FQDN of the primary name server for the zone.
- Zone admin email (RNAME): The email address
of the domain administrator, represented as a domain name. For
example,
admin.example.com - Minimum TTL: (Optional) The minimum TTL value of the zone, in seconds. The value must be between 0 and 86400 seconds inclusively. If left blank, the default value is 300 seconds.
Enhancements to clearing the cache of DNS resolver service
The Clear cache option of a site has been enhanced to
allow you to clear the cache of specific domains within the site. When you
select the Clear cache button, you can now choose to
Clear all cache of all domains within the site or
Clear cache on specific domains where you can
enter a list of domains that you would like to clear from the cache.
Additionally, this enhancement includes support for clearing wildcard
domains, such as *.example.com.
Resolved issues
Recursive namespaces can provide empty answers with public root hints
Previously, when the recursive namespaces are configured to use public root hints, DNS resolver service prevents records with private addresses from being served, resulting in empty answers in query responses. This issue has now been resolved.
What's new
Enhancements to Address Manager discovery
- Also forward queries to 'Other DNS servers'—when the discovery configuration discovers servers within Address Manager with the Other DNS Server role, servers with this role are treated the same way as BlueCat DNS/DHCP Servers and queries will also be forwarded to servers with the Other DNS Server role.
- Discovery hidden primary—the discovery configuration also discovers servers within Address Manager with the Hidden primary role and uses those servers for forwarding queries.
- Discovery stealth secondary—the discovery configuration also discovers servers within Address Manager with the Stealth secondary role and uses those servers for forwarding queries.
- Forward queries for delegated zones to 'Other DNS servers'—when the discovery configuration discovers a zone with roles only pointing to a server with the Other DNS Server role, treat the zone as a delegation zone and forward queries to it directly from BlueCat Edge.
Support for VM-assigned role authentication in AWS and Azure
Discovery Instance v25.3 introduces support to use the VM-assigned roles to authenticate for discovery instances deployed to service point VMs in AWS or Azure environments. When configuring a discovery configuration, you can now select the Use VM role for authentication check box to allow the discovery instance to use the roles assigned to the service point VM for authentication to perform in-cloud discovery of AWS or Azure resources.
Support for Azure Key Vault
Removal of dynamic domain lists
BlueCat Edge v25.3 removes the ability to configure Dynamic domain lists from the Edge UI and API.
Removal of Text filtering from the DNS activity page
BlueCat Edge v25.3 removes the Text filter capabilities from the DNS activity page. You can use the table filters to filter the DNS activity data.
BlueCat Edge v25.3.0 resolves the following security vulnerabilities:
| CVE | Description |
|---|---|
| CVE-2022-39377 | sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1. |
| CVE-2023-7008 | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records. |
| CVE-2023-33204 |
sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. |
| CVE-2023-50387 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. |
| CVE-2023-50868 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. |
| CVE-2025-4598 |
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality. |
| CVE-2025-9230 |
An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. |
| CVE-2025-9714 |
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled. |
| CVE-2025-41244 | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. |