Knot Resolver up to and including 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filters.
nic knot resolver