Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-26249

Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specifically, a single client query may lead to a hundred TCP connection attempts if a DNS server closes connections without providing a response.

Published

2023-02-21T02:15:10.293

Last Modified

2025-03-14T19:15:41.807

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses

Type: Primary
CWE-770
Type: Secondary
CWE-770

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nic	knot_resolver	< 5.6.0	Yes

References

https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html Release Notes, Vendor Advisory ([email protected])
https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)