CVE-2026-45557: Technitium DNS Server DoS Vulnerability

CVE-2026-45557 Overview

CVE-2026-45557 affects Technitium DNS Server, an open-source DNS resolver widely deployed for self-hosted name resolution. The server aggressively retries fetching missing Resource Record Signature (RRSIG) records or mismatched DNS Key (DNSKEY) records during DNSSEC validation. An attacker who controls an authoritative domain can weaponize this behavior to force a vulnerable resolver into generating excessive outbound network traffic. The flaw is tracked under CWE-405: Asymmetric Resource Consumption (Amplification). Technitium addressed the issue in version 15.0.

Critical Impact
A remote, unauthenticated attacker controlling a malicious domain can trigger sustained traffic amplification from a vulnerable Technitium DNS Server, degrading availability and consuming upstream bandwidth.

Affected Products

Technitium DNS Server versions prior to 15.0
Self-hosted DNS deployments performing DNSSEC validation
Recursive resolvers configured to validate signatures for attacker-reachable zones

Discovery Timeline

2026-05-19 - CVE CVE-2026-45557 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-45557

Vulnerability Analysis

The vulnerability resides in the DNSSEC validation logic of Technitium DNS Server. When the resolver encounters a signed response missing the expected RRSIG records, or when the DNSKEY material does not match the signature chain, it repeatedly attempts to refetch those records from the authoritative server. The retry loop lacks adequate rate limiting and backoff controls. An attacker who operates the authoritative name server for a domain can deliberately serve malformed or inconsistent DNSSEC responses. Each lookup triggered against the malicious zone causes the resolver to emit many additional queries, amplifying request volume well beyond what the original client requested. This maps to [CWE-405] (asymmetric resource consumption) and constitutes a network-driven denial of service condition affecting availability.

Root Cause

The resolver does not impose strict bounds on retries when DNSSEC validation fails due to missing RRSIG records or DNSKEY mismatches. The validation path treats absent or inconsistent cryptographic material as a recoverable error and retries fetches aggressively rather than failing closed.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker registers or controls a domain, configures the authoritative server to return responses with missing RRSIG records or inconsistent DNSKEY material, and induces a victim resolver to query that zone. Each induced query produces disproportionate outbound traffic from the resolver to the attacker-controlled authority.

No verified public exploit code is available. See the CVE Record for CVE-2026-45557 and the CISA CSAF Report VA-26-138-02 for additional technical context.

Detection Methods for CVE-2026-45557

Indicators of Compromise

Sustained spikes in outbound DNS query volume from Technitium DNS Server instances to a small set of external authoritative servers
Repeated queries for the same RRSIG or DNSKEY records for a single zone within short intervals
Elevated CPU or socket utilization on the DNS server with no corresponding increase in client-side queries
DNSSEC validation failure log entries referencing missing RRSIG or mismatched DNSKEY records

Detection Strategies

Baseline normal recursive query rates and alert on deviations targeting individual external zones
Parse Technitium DNS Server logs for repeated DNSSEC validation failures associated with the same domain
Correlate egress NetFlow or packet capture data with internal resolver activity to identify amplification patterns

Monitoring Recommendations

Track outbound UDP/TCP port 53 traffic per upstream destination and flag asymmetric query-to-response ratios
Monitor process resource usage of the DnsServer service for sustained anomalies
Forward DNS server logs to a centralized analytics platform for retention and correlation with threat intelligence on malicious domains

How to Mitigate CVE-2026-45557

Immediate Actions Required

Upgrade Technitium DNS Server to version 15.0 or later, which contains the official fix
Inventory all internal DNS resolvers and confirm version status before exposing them to recursion for untrusted clients
Restrict recursion to trusted internal client ranges to reduce exposure to attacker-induced lookups

Patch Information

The vendor fixed the issue in Technitium DNS Server version 15.0. Refer to the GitHub DnsServer Changelog for release details and upgrade instructions.

Workarounds

Apply egress rate limiting on the DNS server host to cap outbound queries per destination zone
Block resolution of known attacker-controlled domains at the firewall or via Response Policy Zones (RPZ)
Temporarily disable DNSSEC validation only as a last resort, accepting the loss of integrity guarantees until patching is complete

bash

# Example: rate limit outbound DNS from the resolver host using iptables
iptables -A OUTPUT -p udp --dport 53 -m hashlimit \
  --hashlimit-name dns_out \
  --hashlimit-mode dstip \
  --hashlimit-above 50/sec \
  --hashlimit-burst 100 \
  -j DROP