CVE-2019-19331

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-16 · updated 2026-06-17
Weakness: CWE-407

Description

knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).

Affected products

Debian Linux: 10.0
CZ.NIC knot-resolver: before 4.3.0 — fixed in 4.3.0

How to fix

Upgrade to a fixed version: CZ.NIC knot-resolver 4.3.0. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19331
https://lists.debian.org/debian-lts-announce/2024/04/msg00017.html
https://www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19331
https://lists.debian.org/debian-lts-announce/2024/04/msg00017.html
https://www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.html

Get alerted when CVE-2019-19331 or the next vulnerability affects your stack