CVE-2026-71194
published 2026-08-12CVE-2026-71194: In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the…
PriorityP336medium6.8CVSS 3.1
AVNACHPRNUINSCCNINAH
EPSS
0.51%
41.1th percentile
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | designate | >= 1.0.0 < 20.0.2 | 20.0.2 |
| openstack | designate | >= 21.0.0 < 21.0.1 | 21.0.1 |
| openstack | designate | >= 22.0.0 < 22.0.2 | 22.0.2 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests.
ghsa_unreviewed·2026-08-13
CVE-2026-71194 [MEDIUM] CWE-669 In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests.
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
VulDB
OpenStack Designate up to 20.0.1/21.0.0/22.0.1 mDNS _handle_notify input validation (EUVD-2026-57692)
vuldb·2026-08-13·CVSS 6.8
CVE-2026-71194 [MEDIUM] OpenStack Designate up to 20.0.1/21.0.0/22.0.1 mDNS _handle_notify input validation (EUVD-2026-57692)
A vulnerability labeled as problematic has been found in OpenStack Designate up to 20.0.1/21.0.0/22.0.1. The impacted element is the function _handle_notify of the component mDNS Handler. Executing a manipulation can lead to improper input validation.
This vulnerability appears as CVE-2026-71194. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
Red Hat
openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup
vendor_redhat·2026-08-11·CVSS 9.6
CVE-2026-71194 [CRITICAL] CWE-863 openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup
openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup
A flaw was found in the OpenStack Designate mDNS NOTIFY handler. The _handle_notify method performs zone lookups without pool_id scoping, unlike the QUERY and AXFR handlers which were previously updated to be pool-aware. When zones with the same name exist across different DNS pools, the storage layer finds multiple matches and raises a NotFound exception, causing all NOTIFY processing for the affected zone name to fail. This results in denial of service for DNS zone transfer notifications, causing stale zone data on secondary DNS servers. The mDNS NOTIFY path is reachable via unauthenticated UDP on port 5354.
Statement: Red Hat OpenStack Platform (RHOSP) ships Designate across multiple versions. The mDNS
No detection rules found.
No public exploits indexed.
2026-08-12
Published