Openstack Designate vulnerabilities

CVE-2026-71193 [CRITICAL] CWE-863 CVE-2026-71193: In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the dupl In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's

CVE-2026-71194 [MEDIUM] CWE-669 CVE-2026-71194: In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving re In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is expl

CVE-2015-5694 [MEDIUM] CWE-835 CVE-2015-5694: Designate does not enforce the DNS protocol limit concerning record set sizes Designate does not enforce the DNS protocol limit concerning record set sizes

CVE-2015-5695 [MEDIUM] CWE-400 CVE-2015-5695: Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per d Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.