Medium [CVE-2026-71194] mDNS NOTIFY handler DoS via pool-blind zone lookup
This medium-severity Red Hat Linux advisory covers CVE-2026-71194 affecting Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path.
The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations.
BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration. The _handle_notify method performs zone lookups without pool_id scoping, unlike the QUERY and AXFR handlers which were previously updated to be pool-aware.
When zones with the same name exist across different DNS pools, the storage layer finds multiple matches and raises a NotFound exception, causing all NOTIFY processing for the affected zone name to fail. This results in denial of service for DNS zone transfer notifications, causing stale zone data on secondary DNS servers.
The mDNS NOTIFY path is reachable via unauthenticated UDP on port 5354. Red Hat OpenStack Platform (RHOSP) ships Designate across multiple versions.
- < 22.0.2
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Mitigation checklist
- Restrict network access to the mDNS service port (default 5354/UDP and TCP) using firewall rules, allowing only traffic from known DNS master servers. Note that enabling the 'query_enforce_tsig' option does NOT protect the NOTIFY handler path, as it only applies to QUERY and AXFR operations. To prevent the precondition of colliding zones: verify that the 'scheduler_filters' configuration option in the [service:central] section uses 'default_pool' (the default) or 'pool_id_attribute' instead of 'attribute'. This prevents unauthorized creation of zones in alternative pools.
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.