Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specifically, a single client query may lead to a hundred TCP connection attempts if a DNS server closes connections without providing a response.
References
Link | Resource |
---|---|
https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html | Release Notes Vendor Advisory |
Configurations
History
02 Mar 2023, 23:20
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-770 | |
CPE | cpe:2.3:a:nic:knot_resolver:*:*:*:*:*:*:*:* | |
References | (MISC) https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html - Release Notes, Vendor Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
21 Feb 2023, 14:50
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-02-21 02:15
Updated : 2024-02-04 23:14
NVD link : CVE-2023-26249
Mitre link : CVE-2023-26249
CVE.ORG link : CVE-2023-26249
JSON object : View
Products Affected
nic
- knot_resolver
CWE
CWE-770
Allocation of Resources Without Limits or Throttling