knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization.

Published 6 y ago 2019-12-16 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

2.1%

percentile 82%

Public exploits

none known

knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).

Exploit prediction (EPSS)

2.11% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
CNA	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:N/A:P`

Affected products

CZ.NIC knot-resolver

Classification

Weakness

CWE-407 Inefficient Algorithmic Complexity
CWE-404 Improper Resource Shutdown or Release

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-19331 · x_transferred
knot-resolver.cz /2019-12-04-knot-resolver-4.3.0.html · x_transferred
lists.debian.org /debian-lts-announce/2024/04/msg00017.html · mailing-list, x_transferred

Sources

CVE List: CVE-2019-19331
NVD: CVE-2019-19331

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.