Announcement date: May 15, 2026
What's new
Certificate support in Edge secrets manager
BlueCat Edge v26.1.0 introduces the ability to store certificates in Edge secrets manager. These certificates can be used to provide a secure method for configuring certificate information for multiple services, including DoH and DoT sites, and SSO integrations.
DoH and DoT namespace support
BlueCat Edge v26.1.0 introduces the ability to configure DNS over HTTPS (DoH) and DNS over TLS (DoT) for namespace forwarders, ensuring that BlueCat Edge acts as a secure DNS client, forwarding queries to upstream resolvers.
DoH and DoT endpoint support
BlueCat Edge v26.1.0 introduces the ability to configure DNS over HTTPS (DoH) and DNS over TLS (DoT) for sites, ensuring that BlueCat Edge provides secure and encrypted DNS resolution for internal clients, protecting their privacy and preventing DNS spoofing.
SSO support for custom Auth0 self-signed certificates
BlueCat Edge v26.1.0 introduces support for custom Auth0 self-signed certificates within SSO integrations.
SSO support for custom SAML responses for IdP
Previously, SAML configurations within BlueCat Edge required that the SAML admin attribute contain the ADMIN role. Starting in BlueCat Edge v26.1.0, you can use the alternative BC_ADMIN role in the scenarios where the ADMIN role cannot be used or allowed in certain configurations.
Resolved issues
Edge sites display Failed update statuses for DRS updates that have succeeded
Previously, if a DNS resolver service update was initiated on a service point and the upgrade completed successfully shortly after the timeout limit, the Site details might display that the DRS updated failed.
What's new
Multi-NIC configuration support
Service Point v26.1.0 introduces the new nic command line
tool that allows you to create, view, modify, and delete network interfaces
and routes on the service point.
Support for NTP over Anycast and upstream NTP over TLS
Service Point v26.1.0 introduces the ability to enable NTP service using Anycast, as well as support for upstream NTP over TLS (NTS).
What's new
DoH and DoT namespace support
DNS resolver service v26.1.0 supports DNS over HTTPS (DoH) and DNS over TLS (DoT) for namespace forwarders, ensuring that BlueCat Edge acts as a secure DNS client, forwarding queries to upstream resolvers.
DoH and DoT endpoint support
DNS resolver service v26.1.0 supports DNS over HTTPS (DoH) and DNS over TLS (DoT) for sites, ensuring that BlueCat Edge provides secure and encrypted DNS resolution for internal clients, protecting their privacy and preventing DNS spoofing.
Support for disabling querylogging
DNS resolver service v26.1.0 introduces the ability to disable querylogging, allowing you to operate the DNS resolver service to operate in a pure resolution mode without the overhead of sending query logs to the BlueCat Edge cloud or a SIEM solution.
Resolved issues
Block policies that redirect to a domain in an exception list result in query log issues
Previously, when you configured a block policy to redirect to a domain that exists in an exception list, the query log did not display a policy applied in the queries enacted on those policies.
DNS resolver service cannot bypass proxy for custom logging endpoints
hotfix script.
Changes in behavior
Changes to policy enactment when queries match multiple policies of the same type
Previously, if a DNS query matches all conditions for multiple policies with different redirect destinations, the query is answered with one of the redirected destinations in a random order, resulting in unexpected behavior. Configuring policies with overlapping conditions that can result in a query matching more than one policy is unsupported.
- The most specific response IP address
- The most specific domain match
- The most specific source IP address
If a DNS query matches the criteria of multiple policies equally, the policy selected is then based on the policy ID.
Resolved issues
Discovery instance fails to discover GCP projects with public DNS zones
Previously, the Discovery instance would fail to discover any GCP projects that contained a public DNS zone.
BlueCat Edge v26.1.0 resolves the following security vulnerabilities:
| CVE | Description |
|---|---|
| CVE-2023-4806 | A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. |
| CVE-2023-7008 | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records. |
| CVE-2023-50387 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. |
| CVE-2023-50868 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. |
| CVE-2024-5569 | A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp. |
| CVE-2024-6174 | When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration. |
| CVE-2024-8176 | A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage. |
| CVE-2024-9681 | When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with hosts like x.example.com as well as example.com where the first host is a subdomain of the second host. The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem. When x.example.com responds with Strict-Transport-Security: headers, this bug can make the subdomain's expiry timeout bleed over and get set for the parent domain example.com in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to example.com get converted to HTTPS for a different period of time than what was asked for by the origin server. If example.com for example stops supporting HTTPS at its expiry time, curl might then fail to access http://example.com until the wrongly set timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended. |
| CVE-2024-11584 | cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands. |
| CVE-2025-4598 | A vulnerability was found in systemd-coredump. A race condition could allow a local attacker to access core dumps of privileged SUID processes. |
| CVE-2025-6965 | SQLite before 3.50.2 could allow aggregate terms to exceed the number of available columns, leading to memory corruption. |
| CVE-2025-8058 | glibc regcomp() versions 2.4 through 2.41 could double-free memory after an allocation failure, potentially allowing buffer manipulation. |
| CVE-2025-9820 | GnuTLS gnutls_pkcs11_token_init() could write past a fixed-size stack buffer when processing an overly long token label. |
| CVE-2025-14831 | GnuTLS could consume excessive CPU and memory when processing malicious certificates containing many name constraints and subject alternative names. |
| CVE-2025-40909 | Perl threads have a working-directory race where cloned directory handles can temporarily change process-wide current working directory, causing unintended file or code access. |
| CVE-2025-61984 | OpenSSH before 10.1 allows control characters in usernames from untrusted sources, potentially leading to code execution when ProxyCommand is used. |
| CVE-2025-61985 | OpenSSH before 10.1 allows the \0 character in an ssh:// URI, potentially leading to code execution when ProxyCommand is used. |
| CVE-2025-68160 | The OpenSSL line-buffering BIO filter could trigger a heap out-of-bounds write when processing large amounts of data without a newline and short writes occur. This typically results in a denial of service. |
| CVE-2025-69418 | The OpenSSL low-level OCB API with hardware-accelerated implementation paths could leave a final partial block unencrypted or unauthenticated. |
| CVE-2025-69419 | The OpenSSL PKCS12_get_friendlyname() function could perform a one-byte write before an allocated buffer when processing crafted PKCS#12 BMPString friendly names. |
| CVE-2025-69420 | OpenSSL timestamp response verification could trigger type confusion, causing an invalid or NULL pointer dereference and denial of service. |
| CVE-2025-69421 | OpenSSL malformed PKCS#12 processing could trigger a NULL pointer dereference in PKCS12_item_decrypt_d2i_ex(), causing denial of service. |
| CVE-2026-1519 | BIND DNSSEC validation of a malicious zone could cause excessive CPU consumption in resolvers. |
| CVE-2026-3497 | Linux distribution OpenSSH GSSAPI patches could continue after sshpkt_disconnect() errors with uninitialized variables, leading to undefined behavior. |
| CVE-2026-22695 | libpng 1.6.51 through 1.6.53 has a heap buffer over-read in png_image_finish_read() with certain interlaced 16-bit PNG images. |
| CVE-2026-22795 | OpenSSL malformed PKCS#12 parsing could cause an invalid or NULL pointer dereference and denial of service. |
| CVE-2026-22796 | OpenSSL PKCS#7 signature verification type confusion could cause an invalid or NULL pointer dereference and denial of service. |
| CVE-2026-22801 | libpng 1.6.26 through 1.6.53 has integer truncation in simplified write APIs that can cause a heap buffer over-read with negative or very large row strides. |
| CVE-2026-25646 | libpng before 1.6.55 has an out-of-bounds read in png_set_quantize() that can read past an internal heap buffer. |
| CVE-2026-28387 | OpenSSL DANE TLSA client authentication in uncommon configurations could trigger use-after-free or double-free behavior on the client side. |
| CVE-2026-28388 | OpenSSL delta CRL processing could NULL-dereference when a required CRL Number extension is missing, causing denial of service. |
| CVE-2026-28389 | OpenSSL CMS EnvelopedData with KeyAgreeRecipientInfo could NULL-dereference during processing, causing denial of service. |
| CVE-2026-28390 | OpenSSL CMS EnvelopedData with KeyTransportRecipientInfo and RSA-OAEP could NULL-dereference, causing denial of service. |
| CVE-2026-31431 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. |
| CVE-2026-32597 | PyJWT before 2.12.0 does not validate the JWS crit header parameter and accepts unknown critical extensions. |
| CVE-2026-33416 | libpng 1.2.1 through 1.6.55 aliases palette and transparency buffers across structures, leading to dangling pointers and use-after-free behavior. |
| CVE-2026-33636 | libpng 1.6.36 through 1.6.55 has out-of-bounds read/write behavior in ARM/AArch64 Neon palette expansion during crafted PNG decoding. |
| CVE-2026-34757 | libpng before 1.6.57 could read from freed memory when pointers returned by getter APIs are passed back into corresponding setter APIs. |
| CVE-2026-43284 | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data(). |