Attacker can trigger assertion failure in DNSdist by sending zone transfer request over DNS over HTTPS

CVE-2024-25581

What is CVE-2024-25581?

A vulnerability exists in DNSdist when DNS over HTTPS support is enabled and queries are misrouted to a tcp-only or DNS over TLS backend. An attacker can exploit this flaw by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, which results in an assertion failure within the DNSdist process. This leads to service interruption and potential Denial of Service conditions. Notably, DNS over HTTPS is not enabled by default and, by default, the system utilizes plain DNS (Do53) for backend communications, creating a specific attack vector under certain configurations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References