CVE-2026-40719: MaraDNS Deadwood DoS Vulnerability

CVE-2026-40719 Overview

CVE-2026-40719 is a resource exhaustion vulnerability in Deadwood, the recursive DNS resolver component of MaraDNS version 3.5.0036. This flaw allows remote attackers to exhaust connection slots by configuring a zone whose authoritative nameserver address cannot be resolved. When exploited, this denial of service condition can render the DNS resolver unavailable to legitimate users.

Critical Impact

Remote attackers can exhaust DNS resolver connection slots, causing service disruption for all DNS resolution requests.

Affected Products

• MaraDNS 3.5.0036
• Deadwood recursive DNS resolver component

Discovery Timeline

• 2026-04-15 - CVE-2026-40719 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-40719

Vulnerability Analysis

This vulnerability is classified under CWE-670 (Always-Incorrect Control Flow Implementation), indicating a fundamental flaw in how Deadwood handles unresolvable authoritative nameserver addresses. When the resolver attempts to query a zone with an authoritative nameserver that cannot be resolved, the connection slot used for that query is not properly released or recycled.

The vulnerability can be exploited remotely without authentication or user interaction. An attacker can craft malicious DNS zones that reference non-existent or unresolvable authoritative nameservers, causing Deadwood to consume connection slots indefinitely while attempting resolution. Once all available connection slots are exhausted, the DNS resolver becomes unable to process legitimate queries, effectively causing a denial of service.

Root Cause

The root cause stems from improper control flow handling when Deadwood encounters an authoritative nameserver address that cannot be resolved. The implementation fails to properly release or timeout connection slots that are stuck in an unresolvable state, leading to progressive resource exhaustion.

Attack Vector

The attack is network-based and can be executed remotely. An attacker would need to either control a malicious DNS zone or be able to influence DNS responses to direct the target Deadwood resolver toward zones with unresolvable authoritative nameservers. The attack requires no privileges and no user interaction, making it straightforward to execute once the conditions are met.

The vulnerability manifests in the connection slot management logic when handling DNS resolution failures. When an authoritative nameserver address cannot be resolved, the connection slot enters a state where it is neither released nor properly recycled, leading to gradual exhaustion of available slots. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-40719

Indicators of Compromise

• Sudden increase in connection slot utilization on Deadwood DNS resolver instances
• DNS query timeouts or failures affecting all clients
• Log entries showing repeated resolution failures for specific authoritative nameservers
• Unusual patterns of DNS queries targeting zones with unresolvable nameservers

Detection Strategies

• Monitor Deadwood connection slot usage and alert when utilization approaches maximum capacity
• Implement anomaly detection for DNS resolution failure rates
• Track and alert on DNS zones that consistently fail nameserver resolution
• Review DNS logs for repeated queries to the same unresolvable authoritative nameservers

Monitoring Recommendations

• Configure connection pool monitoring with threshold-based alerting on Deadwood instances
• Implement service availability monitoring for DNS resolution functionality
• Enable verbose logging for DNS resolution failures to identify attack patterns
• Deploy network-level monitoring to detect unusual DNS traffic patterns

How to Mitigate CVE-2026-40719

Immediate Actions Required

• Update MaraDNS to a patched version as documented in the MaraDNS Change Log
• Review connection slot limits and consider implementing rate limiting
• Monitor DNS resolver health and implement automatic restart procedures if resource exhaustion is detected
• Consider deploying redundant DNS resolvers to maintain availability during attacks

Patch Information

Security patches are available for this vulnerability. Consult the MaraDNS Change Log for the latest patched version and upgrade instructions. The GitHub Security Advisory provides additional details on the fix.

Workarounds

• Implement connection slot timeouts at the network or application level to prevent indefinite slot consumption
• Deploy DNS resolver redundancy to maintain service availability if one instance becomes affected
• Configure rate limiting on incoming DNS queries to slow down potential exhaustion attacks
• Consider implementing upstream DNS filtering to block queries to known malicious or suspicious zones

# Configuration example
# Monitor Deadwood connection status (check MaraDNS documentation for specific commands)
# Implement periodic service health checks
watch -n 5 'netstat -an | grep :53 | wc -l'

# Consider setting up automatic restart if connection issues are detected
# Consult MaraDNS documentation for specific configuration parameters