What is the CVSS score of CVE-2026-36478?

CVE-2026-36478 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Technitium DNS Server are affected by CVE-2026-36478?

Technitium DNS Server versions 14.3 and earlier contain a remote denial-of-service vulnerability that allows unauthenticated network attackers to crash or hang the DNS service, potentially disrupting…

How to fix or mitigate CVE-2026-36478?

Within 24 hours, inventory all systems running Technitium DNS Server and confirm version numbers; immediately restrict network access to the DNS service to authorized internal clients only via firewall rules and disable external exposure if currently enabled. Within 7 days, implement query rate limiting on DNS interfaces, configure traffic filtering to block malformed DNS packets, and establish baseline logging for anomaly detection. Within 30 days, monitor the Technitium DNS project for patched versions, develop a migration plan to alternative DNS solutions, and test failover procedures.

Technitium DNS Server CVE-2026-36478

EUVD-2026-39933 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-26 mitre

GHSA-fq83-8h88-7gf5

Denial Of Service Red Hat N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remotely reachable DNS service, no auth or user interaction, low complexity; impact is availability-only resource exhaustion with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:11 vuln.today

CVE Published

Jun 26, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jun 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServerApp.dll, TechnitiumLibrary.Net/Dns/DnsClient.cs components

AnalysisAI

Remote denial-of-service in Technitium DNS Server versions 14.3 and earlier lets an unauthenticated network attacker exhaust server resources (CWE-400) through the DNS client handling logic in TechnitiumLibrary.Net/Dns/DnsClient.cs, crashing or hanging the DNS service. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially reachable remote triggering with high availability impact but no confidentiality or integrity loss. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with SSVC recording exploitation status as 'none'.

Technical ContextAI

Technitium DNS Server is a free, cross-platform, self-hosted authoritative and recursive DNS server written in .NET, distributed as DnsServerApp.exe/DnsServerApp.dll and built on the TechnitiumLibrary.Net networking library. The named component, TechnitiumLibrary.Net/Dns/DnsClient.cs, is the resolver/forwarder path the server uses to issue and parse upstream DNS queries, so the flaw sits in DNS message handling rather than the management UI. The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), meaning specially crafted or high-volume DNS interactions can drive CPU, memory, or thread/socket consumption beyond safe limits, degrading or halting service without any memory-corruption or code-execution primitive.

RemediationAI

Upgrade to the fixed Technitium DNS Server release documented in the vendor changelog (https://github.com/TechnitiumSoftware/DnsServer/blob/aa9044d4df9d739b6a6e428bb77cecb3356b775b/CHANGELOG.md) - a changelog entry is referenced for this issue but the exact patched version is not independently confirmed from the provided data, so validate the target release against technitium.com before deploying. Until patched, reduce exposure by not publishing the DNS service directly to the internet: restrict UDP/TCP 53 and the recursion/forwarder path to trusted client subnets via firewall rules, disable open recursion for external clients, and enable per-client rate limiting (QPS limits) available in Technitium to blunt resource-exhaustion attempts; trade-offs are that overly tight recursion/ACL restrictions can break resolution for legitimate remote clients and aggressive rate limits may drop bursts of valid queries. Monitor CPU/memory and add process auto-restart (systemd/service watchdog) as a stopgap to recover availability after a crash.