Bug 2458633
| Summary: | CVE-2026-40719 maradns: MaraDNS: Denial of Service via unresolvable authoritative nameserver address [fedora-all] | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Alexander B <abushkin> |
| Component: | maradns | Assignee: | Tomasz Torcz <tomek> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 45 | CC: | maradns, tomek |
| Target Milestone: | --- | Keywords: | Security, SecurityTracking |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | {"flaws": ["6685b49e-77c8-4727-ab95-ff9a07580326"]} | ||
| Fixed In Version: | maradns-3.5.0039-1.fc44 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-10-23 01:22:14 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2458623 | ||
|
Description
Alexander B
2026-04-15 09:42:08 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45. Upstream here: WONTFIX The denial of service only temporarily uses more resources and once the request for a server whose glueless nameservers doesn’t exist stops, Deadwood releases the resources and functions properly within a minute. This is just a flooding attack with extra steps. In addition, only IPs authorized to perform recursive queries can perform the attack, and in today’s internet, I’ve seen people have their virtual servers put offline by their hosting providers for having an open DNS recurser on their network. Further discussion: https://github.com/samboy/MaraDNS/security/advisories/GHSA-cfc6-vhrv-62cj I have made a patch for this minor security issue (it’s incorrectly labeled as a "high impact" security issue in the CVE) which simply disables recursion. This patch will not be applied to the upstream source code, but this patch can be used if it’s necessary to have MaraDNS be patched against all known CVE issues: https://samboy.github.io/MaraDNS/patches/MaraDNS-CVE-2026-40719.patch.txt Sam, thanh you for your engagement! I'll look into update MaraDNS in Fedora on the weekend, if time permits. Upstream here: I think this CVE report is best ignored. Deadwood's recursion is a very compact implementation (~64k in size) which only uses a couple of megabytes of memory at its default settings. It mostly works (but doesn't have IPv6, isn't bug-for-bug identical to BIND9, doesn't have EDNS0 support, and yes it can be overloaded) but it's not a recursor to use with a public IP as an open resolver. It's also secure: Yes, a jerk with recursion access can temporarily overload the resolver, but said jerk won't (as far as we know) be able to obtain remote access because a router is running Deadwood. A thought: Another mitigation would be to require the recursion to only run if the IP Deadwood is on is RFC1918 or localhost. FEDORA-2026-eb61896ed1 (maradns-3.5.0039-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-eb61896ed1 FEDORA-2026-eb61896ed1 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-eb61896ed1` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-eb61896ed1 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-eb61896ed1 (maradns-3.5.0039-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. |