CVE-2026-42255
Technitium Dnsserver ≤ 15.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:LSummary
CVE-2026-42255 is a high-severity Incorrect Provision of Specified Functionality (CWE-684) vulnerability in Technitium Dnsserver. Its CVSS base score is 7.2 (High).
Operationally, ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-42255 is a vulnerability in Technitium DNS Server versions prior to 15.0 that enables DNS traffic amplification through cyclic name server delegation, as classified under CWE-684. This flaw allows attackers to exploit improper handling of recursive DNS queries, leading to amplified responses. The vulnerability received a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L), indicating high severity due to its network accessibility, low complexity, and lack of required privileges or user interaction.
Unauthenticated attackers with network access can exploit this vulnerability remotely by crafting DNS queries that trigger cyclic delegations, causing the server to generate significantly larger response traffic than the initial query. This results in a denial-of-service condition through traffic amplification, with low impacts on integrity (such as potential query poisoning) and availability, while changing the scope to affect dependent systems.
The Technitium DNS Server changelog at https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#technitium-dns-server-change-log documents the fix in version 15.0, recommending administrators upgrade to this or later versions to mitigate the issue by preventing cyclic delegation amplification. No workarounds are specified in available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25688
Vulnerability Data
Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation activities are performed precisely to discover when delivered functionality fails to match published specifications.
Requiring a documented development process and supporting tools reduces the chance that specified functionality will be implemented incorrectly.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce spec-compliant functionality and testing, while eliminating this weakness fulfills only part of the control's broader monitoring intent.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance validates that implemented functionality conforms to specifications before release.
Secure development life cycle includes requirements and verification activities that directly reduce the risk of delivering functionality that deviates from published specifications.
Explicit application security requirements and acceptance criteria help ensure the delivered software matches its intended specifications.
Change management processes reduce the chance of unintended functional deviations during updates, though they do not directly address initial specification conformance.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
RHEL 9 (1 rule)
- V-258078 RHEL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-684