CVE-2026-36478: Technitium DNS Server Remote Denial of Service

Technical summary

CVE-2026-36478 is a denial-of-service vulnerability in Technitium DNS Server affecting version 14.3 and prior releases. The flaw exists in the core DNS processing components (DnsServerApp.exe, DnsServerApp.dll, and TechnitiumLibrary.Net/Dns/DnsClient.cs) and stems from improper handling of network input, classified under CWE-400 (uncontrolled resource consumption). The vulnerability has a CVSS 3.1 score of 7.5 (HIGH severity) with a network-based attack vector requiring no authentication, low attack complexity, and high availability impact.

Business impact

Organizations operating Technitium DNS Server in production face potential service disruption. A successful attack can knock the DNS service offline, preventing internal and external name resolution and potentially cascading failures across dependent applications, cloud connectivity, and user productivity. Organizations without secondary DNS infrastructure or failover mechanisms are at heightened risk of extended downtime.

Affected systems

Technitium DNS Server version 14.3 and all earlier versions are affected. Organizations should inventory deployments in network environments, including both primary and secondary DNS roles. The vulnerability affects the core DNS resolution engine regardless of deployment context (physical, virtual, containerized).

Exploitability

This vulnerability is exploitable remotely over the network without requiring authentication, valid credentials, or user interaction. The attack complexity is low, meaning a standard network request can trigger the denial-of-service condition. Exploitation requires no specialized tools beyond basic network capabilities, making the barrier to attack relatively low.

Remediation

Upgrade Technitium DNS Server to a version released after 14.3. Organizations should verify the specific patched version number from the official Technitium project releases before deploying. Test patched versions in a staging environment to confirm DNS functionality and service stability before production rollout.

Patch guidance

Obtain the latest stable release from the official Technitium DNS Server project repository or distribution channel. Verify that the update version is explicitly documented as addressing CVE-2026-36478 or is released after the published date (2026-06-26). For critical DNS services, schedule patching during a maintenance window and confirm service health post-deployment. If operating a secondary DNS server, prioritize patching the primary first, then secondary to maintain resolution capability during updates.

Detection guidance

Monitor DNS server logs and process behavior for unusual resource consumption, unexpected crashes, or repeated restarts of DnsServerApp.exe. Implement network-based detection for anomalous DNS query patterns, such as malformed packets or requests that trigger high CPU or memory usage on the DNS service. Alert on any availability gaps in DNS resolution or service recovery events. Consider baseline profiling of normal DNS traffic to establish detection thresholds.

Why prioritize this

HIGH severity combined with unauthenticated remote exploitability and no user interaction required makes this a credible threat to DNS infrastructure availability. DNS is critical to all network operations; loss of DNS service directly impacts business continuity. The absence of KEV status does not diminish operational risk. Organizations with standalone or single-point-of-failure DNS infrastructure should prioritize patching immediately.

Risk score, explained

CVSS 7.5 (HIGH) reflects the confluence of network accessibility (AV:N), low attack complexity (AC:L), absence of authentication (PR:N), no special user interaction (UI:N), and high impact on availability (A:H). The score appropriately reflects that while confidentiality and integrity are not affected, a denial-of-service condition against critical DNS infrastructure poses substantial operational risk. Actual risk may be elevated in environments with single DNS servers or minimal redundancy.

Frequently asked questions