Golang Org X Net Dns Dnsmessage
Monthly
Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any application that parses attacker-supplied DNS responses by sending a malformed SVCB or HTTPS resource record. When the declared size of a service-parameter value exceeds the remaining DNS message buffer, the parser panics instead of returning an error, taking down the DNS client, resolver, or proxy embedding this library. EPSS is low (0.15%) and there is no public exploit identified at time of analysis, but a vendor patch is available and the pre-conditions are trivial for any host that resolves DNS through untrusted responders.
Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any application that parses attacker-supplied DNS responses by sending a malformed SVCB or HTTPS resource record. When the declared size of a service-parameter value exceeds the remaining DNS message buffer, the parser panics instead of returning an error, taking down the DNS client, resolver, or proxy embedding this library. EPSS is low (0.15%) and there is no public exploit identified at time of analysis, but a vendor patch is available and the pre-conditions are trivial for any host that resolves DNS through untrusted responders.