CVE-2019-19331: High severity go-resolver vulnerability
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-19331?
CVE-2019-19331 is a vulnerability in knot-resolver before version 4.3.0 that can be exploited to cause denial of service through high CPU utilization.
How severe is CVE-2019-19331?
CVE-2019-19331 has a severity rating of high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-19331?
Versions of knot-resolver up to, but not including, 4.3.0 are affected by CVE-2019-19331.
How can CVE-2019-19331 be exploited?
CVE-2019-19331 can be exploited by sending DNS replies with a large number of resource records, causing inefficient processing and high CPU utilization.
How can I fix CVE-2019-19331?
To fix CVE-2019-19331, upgrade knot-resolver to version 4.3.0 or later.