CVE-2026-40719
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-40719 is a high-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability in Samiam (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40719 affects the Deadwood component in MaraDNS version 3.5.0036, where attackers can exhaust connection slots by targeting a zone whose authoritative nameserver address cannot be resolved. This vulnerability, published on 2026-04-15, carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-670, indicating a resource exhaustion issue stemming from repeated failed resolution attempts.
Remote attackers require no privileges, authentication, or user interaction to exploit this flaw over the network with low complexity. By sending crafted DNS queries for the problematic zone, they trigger Deadwood to continually attempt connections to the unresolvable nameserver address, depleting available connection slots and causing a denial-of-service condition that impairs the DNS server's availability.
Mitigation details are outlined in the MaraDNS GitHub security advisory (GHSA-cfc6-vhrv-62cj) and the project changelog, accessible at https://github.com/samboy/MaraDNS/security/advisories/GHSA-cfc6-vhrv-62cj and https://maradns.samiam.org/changelog.html, respectively.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22839
Vulnerability Data
Deadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone whose authoritative nameserver address cannot be resolved.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V9.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages directly exercises control-flow paths and reveals mismatches between implemented and intended behavior.
Requiring a documented development process and supporting tools reduces the chance that incorrect control-flow logic is introduced in the first place.
Flaw identification and remediation processes can locate and correct control-flow errors once they manifest as incorrect runtime behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent incorrect control-flow implementations via reviews, testing, and static analysis.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect paths that deviate from intended logic.
Secure development lifecycle processes can catch incorrect control-flow logic during design and code review.
Secure coding standards and reviews directly target flawed control-flow implementations.
Change-management gates may prevent deployment of flawed logic but do not address the coding defect itself.