Zephyr CVE-2025-2962

The CVSS 7.5 score reflects a High-severity vulnerability with critical attack characteristics: Network-accessible (AV:N), no authentication required (PR:N), low attack complexity (AC:L), and no user interaction needed (UI:N). These factors indicate trivial exploitability. However, the impact is limited to availability (A:H) with no confidentiality or integrity compromise (C:N/I:N/S:U), meaning the vulnerability causes service denial rather than data breach. The real-world risk is elevated due to: (1) DNS infrastructure criticality—outages affect all services relying on name resolution; (2) trivial exploitation via network queries; (3) potential for large-scale infrastructure attacks if widely deployed resolver instances are vulnerable. Without EPSS, KEV, or POC data, exploitation probability cannot be quantified, but the low attack complexity and lack of prerequisites suggest active exploitation is likely if the vulnerability is publicly disclosed. Organizations running vulnerable DNS infrastructure should prioritize patching despite the 'availability only' impact due to systemic importance.

An attacker crafts a specially-formed DNS query containing elements that trigger the infinite loop condition in the target resolver's packet processing logic (e.g., deeply nested CNAME chains, malformed name compression pointers, or recursive DNAME references). The attacker sends this query from an Internet-accessible network address to the target DNS resolver on port 53 (UDP or TCP). Upon receipt, the resolver's DNS implementation enters an infinite loop during query processing, consuming CPU and eventually becoming unresponsive to legitimate queries. The resolver crashes or hangs, causing denial of service for all systems depending on it for name resolution. If the resolver is a critical infrastructure component (corporate DNS, ISP nameserver, cloud provider DNS), the outage cascades to dependent services. The attack requires no authentication, minimal technical skill beyond crafting a malformed query, and can be launched from anywhere on the Internet. Multiple queries can sustain the DoS condition; potential for distributed attacks if vulnerability details are widely known.