Resource Consumption Vulnerability in Knot Resolver by CZ.NIC
CVE-2023-26249

7.5HIGH

Key Information:

Vendor

Nic

Status
Knot Resolver
Vendor
CVE Published:
21 February 2023

What is CVE-2023-26249?

The flaw in Knot Resolver versions prior to 5.6.0 allows malicious clients to exploit resource management vulnerabilities, leading to amplification attacks. A typical scenario involves a single client query that instigates multiple TCP connection attempts when a DNS server fails to respond appropriately. This behavior can be harnessed to consume significant system resources and potentially disrupt service availability.

References

https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.