Technitium DNS Server CVE-2026-45557

The attacker must have control over a registered domain and the ability to configure its DNSSEC records (missing RRSIG or mismatched DNSKEY). The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication is required and complexity is low for the attacker - no special privileges or user interaction are needed beyond controlling the malicious domain. The target Technitium DNS Server must be induced to resolve the attacker's domain, either via direct client queries to an open resolver or by manipulating a user or application behind the resolver to trigger the lookup. Exploitation is constrained by the need to cause the target resolver to actually query the attacker-controlled zone; a resolver that never processes queries for the attacker's domain is not affected. The availability impact is rated Low rather than High, meaning exploitation under typical conditions causes degradation rather than complete denial of service.

The CVSS 5.8 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L presents a nuanced risk profile. Attack complexity is Low and no authentication or user interaction is required, meaning any internet-accessible resolver can be triggered simply by an attacker controlling a domain. The Changed Scope flag (S:C) is significant: the availability impact radiates beyond the DNS server itself to affected network infrastructure and potentially upstream resolvers or rate-limited third-party nameservers. However, the availability impact is rated Low (A:L), indicating partial degradation rather than complete outage under typical conditions. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation campaigns at time of analysis. Reported by the CISA Coordination Group (cisa-cg) and referenced in a CISA CSAF advisory (va-26-138-02), which elevates its credibility but does not equate to KEV confirmation. Real-world risk is moderate for internet-facing recursive resolvers, particularly those under bandwidth constraints or operating in high-query environments.

An attacker registers a domain and deliberately configures its DNSSEC zone with absent RRSIG records or intentionally mismatched DNSKEY entries. The attacker then causes the target Technitium DNS Server - for example, by sending spoofed or legitimate client queries - to attempt resolution of that domain. The server enters an aggressive retry loop fetching the malformed DNSSEC records, generating sustained amplified outbound traffic that consumes bandwidth and degrades availability of network resources. No public proof-of-concept code has been identified, but the attack requires only standard domain registration and DNS zone manipulation skills.