Resource exhaustion in Technitium Dnsserver
CVE-2023-28451
An issue was discovered in Technitium 11.0.2. There is a vulnerability (called BadDNS) in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing DoS (denial of service) for normal resolution. The effects of an exploit would be widespread and highly impactful, because the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.005 (42.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Technitium Dnsserver — versions 11.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Product)
- cve@mitre.org (Broken Link)
Frequently asked questions
- What is CVE-2023-28451?
- CVE-2023-28451 is a high-severity vulnerability in Technitium Dnsserver, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2024-09-18.
- How severe is CVE-2023-28451?
- High severity. CVSS v3 base score is 7.5 out of 10.