CVE-2016-6171

High

Published: 09/02/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service through a large zone transfer, leading to memory exhaustion and slave server crash.

Risk Assessment

Organizations may experience service disruptions due to DNS unavailability, potentially affecting applications and systems reliant on DNS.

Recommendation

It is recommended to upgrade Knot DNS to version 2.3.0 or later to mitigate the risk associated with this vulnerability.

Other vulnerabilities in Knot DNS

CVE-2026-39155Medium
In Knot DNS before versions 3.4.10 and 3.5.4, the mod-onlinesign module incorrectly computes the next NSEC owner name, creating an overly broad authenticated denial interval. This allows downstream resolvers using aggressive negative caching to synthesize negative answers for legitimate names, causing resolver-side denial of service.

Original NVD description (English source)

Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS, (2) AXFR, or (3) IXFR.