Attacker can trigger assertion failure in DNSdist by sending zone transfer request over DNS over HTTPS

CVE-2024-25581

Summary

A vulnerability exists in DNSdist when DNS over HTTPS support is enabled and queries are misrouted to a tcp-only or DNS over TLS backend. An attacker can exploit this flaw by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, which results in an assertion failure within the DNSdist process. This leads to service interruption and potential Denial of Service conditions. Notably, DNS over HTTPS is not enabled by default and, by default, the system utilizes plain DNS (Do53) for backend communications, creating a specific attack vector under certain configurations.

References