{"id":"CVE-2019-19331","aliases":["ALPINE-CVE-2019-19331","DEBIAN-CVE-2019-19331","DLA-3795-1","EUVD-2019-8952","GHSA-9f7v-8m4p-pv76","UBUNTU-CVE-2019-19331","USN-7047-1"],"status":"published","title":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU...","description":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02107,"percentile":0.81878,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-404","CWE-407"],"published":"2019-12-16T00:00:00Z","modified":"2026-11-03T06:31:55Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"knot-resolver","fixed_in":["4.3.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"knot-resolver","fixed_in":["5.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"knot-resolver","fixed_in":["5.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"knot-resolver","fixed_in":["5.0.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"knot-resolver","fixed_in":["3.2.1-3ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3+deb10u2"}]}],"versions":["3.2.1-3","3.2.1-3+deb10u1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0~beta2-123-g6134920-1","1.0.0~beta3-1","1.0.0~beta3-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-1","1.5.0-4","1.5.1-1","1.5.2-1","2.0.0-3","2.1.0-1","2.1.0-2","2.1.1-1","2.1.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3ubuntu2.2"}]}],"versions":["3.2.1-3","3.2.1-3ubuntu1","3.2.1-3ubuntu2","3.2.1-3ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"knot-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3ubuntu2.2"}]}],"versions":["3.2.1-3","3.2.1-3ubuntu1","3.2.1-3ubuntu2","3.2.1-3ubuntu2.1"],"bundled":4}],"products":[{"vendor":"cz.nic","product":"knot-resolver"},{"vendor":"debian","product":"debian_linux"},{"vendor":"nic","product":"knot_resolver"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19331","tags":["x_transferred","Exploit","Issue Tracking","Patch","fix"]},{"url":"https://www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.html","tags":["x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00017.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19331"},{"url":"https://github.com/advisories/GHSA-9f7v-8m4p-pv76"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-19331","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19331","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19331","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/12/04/4","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19331","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7047-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12667","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-19331","description":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).","status":"published","published":"2019-12-16T00:00:00Z","modified":"2024-08-05T02:16:46.88Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-8952","description":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).","status":"published","published":"2019-12-16T00:00:00Z","modified":"2024-08-05T02:16:46Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:25.841101Z"}],"ghsa":[{"id":"GHSA-9f7v-8m4p-pv76","title":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU...","description":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).","status":"published","published":"2022-05-24T17:03:44Z","modified":"2024-04-26T09:30:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-404","CWE-407"],"updated_at":"2026-11-02T14:57:15.123011Z"}],"nvd":[{"id":"CVE-2019-19331","description":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).","status":"published","published":"2019-12-16T16:15:11.66Z","modified":"2026-06-17T02:26:30.96Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-407","CWE-404"],"updated_at":"2026-11-02T14:05:40.258829Z"}],"osv":[{"id":"ALPINE-CVE-2019-19331","description":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).","status":"published","published":"2019-12-16T16:15:11.66Z","modified":"2026-11-03T06:31:55.312529458Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-19331","description":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).","status":"published","published":"2019-12-16T16:15:11.66Z","modified":"2026-10-24T10:30:35.819619264Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19331","description":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).","status":"published","published":"2019-12-16T16:15:11.66Z","modified":"2026-09-21T07:00:40.700347631Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-19331","description":"knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).","status":"published","published":"2019-12-16T16:15:00Z","modified":"2026-04-22T12:15:37.505557Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-3795-1","title":"knot-resolver - security update","status":"published","published":"2024-04-26T00:00:00Z","modified":"2026-03-09T01:18:07.178802Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"USN-7047-1","title":"knot-resolver vulnerabilities","description":"Vladimír Čunát discovered that Knot Resolver incorrectly handled input\nduring DNSSEC validation. A remote attacker could possibly use this issue\nto bypass certain validations. (CVE-2019-10190)\n\nVladimír Čunát discovered that Knot Resolver incorrectly handled input\nduring DNSSEC validation. A remote attacker could possibly use this issue\nto downgrade DNSSEC-secure domains to a DNSSEC-insecure state, resulting \nin a domain hijacking attack. (CVE-2019-10191)\n\nVladimír Čunát discovered that Knot Resolver incorrectly handled certain \nDNS replies with many resource records. An attacker could possibly use \nthis issue to consume system resources, resulting in a denial of service.\n(CVE-2019-19331)\n\nLior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Knot\nResolver incorrectly handled certain queries. A remote attacker could \nuse this issue to perform an amplification attack directed at a target.\n(CVE-2020-12667)\n","status":"published","published":"2024-10-01T06:53:06Z","modified":"2026-04-27T17:47:13.764053897Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}