Medium [CVE-2026-71194] mDNS NOTIFY handler DoS via pool-blind zone lookup
This medium-severity Red Hat Linux advisory covers CVE-2026-71194 affecting Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in the OpenStack Designate mDNS NOTIFY handler. The _handle_notify method performs zone lookups without pool_id scoping, unlike the QUERY and AXFR handlers which were previously updated to be pool-aware.
When zones with the same name exist across different DNS pools, the storage layer finds multiple matches and raises a NotFound exception, causing all NOTIFY processing for the affected zone name to fail. This results in denial of service for DNS zone transfer notifications, causing stale zone data on secondary DNS servers.
The mDNS NOTIFY path is reachable via unauthenticated UDP on port 5354. Red Hat OpenStack Platform (RHOSP) ships Designate across multiple versions.
The mDNS NOTIFY handler DoS can occur whenever zone names collide across pools, regardless of how the colliding zones were created. However, in default configurations, only a single pool is used, making collisions unlikely without administrator action or exploitation of CVE-2026-71193.
Multipool deployments using the AttributeFilter scheduler were never a fully supported configuration in any RHOSP version. For Red Hat OpenStack Services on OpenShift (RHOSO, openstack-18.0), the mDNS service defaults to a ClusterIP service type with no NodePort or LoadBalancer exposure, making port 5354 reachable only within the OpenShift cluster network.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Restrict network access to the mDNS service port (default 5354/UDP and TCP) using firewall rules, allowing only traffic from known DNS master servers. Note that enabling the 'query_enforce_tsig' option does NOT protect the NOTIFY handler path, as it only applies to QUERY and AXFR operations. To prevent the precondition of colliding zones: verify that the 'scheduler_filters' configuration option in the [service:central] section uses 'default_pool' (the default) or 'pool_id_attribute' instead of 'attribute'. This prevents unauthorized creation of zones in alternative pools.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.