{"id":"CVE-2023-31137","aliases":["DEBIAN-CVE-2023-31137","DLA-3457-1","DSA-5441-1","EUVD-2023-35457","GHSA-58m7-826v-9c3c","UBUNTU-CVE-2023-31137","USN-6271-1"],"status":"published","title":"MaraDNS Integer Underflow Vulnerability in DNS Packet Decompression","description":"MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.\n\nThe vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.\n\nOne proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len \u003c= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01143,"percentile":0.67118,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191"],"published":"2023-05-09T13:56:46Z","modified":"2026-10-28T10:32:55Z","fixes":[{"ecosystem":"Debian:11","package":"maradns","fixed_in":["2.0.13-1.4+deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"maradns","fixed_in":["2.0.13-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"maradns","fixed_in":["2.0.13-1.2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"maradns","fixed_in":["2.0.13-1.4+deb11u1build0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"maradns","fixed_in":["2.0.13-1.4+deb11u1build0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1.4+deb11u1"}]}],"versions":["2.0.13-1.4"]},{"source":"osv","ecosystem":"Debian:10","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1.2+deb10u1"}]}],"versions":["2.0.13-1.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1.4+deb11u1"}]}],"versions":["2.0.13-1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1ubuntu0.1~esm1"}]}],"versions":["2.0.11-1","2.0.13-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1.2ubuntu0.1~esm1"}]}],"versions":["2.0.13-1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1.4+deb11u1build0.20.04.1"}]}],"versions":["2.0.13-1.2build1","2.0.13-1.4","2.0.13-1.4build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1.4+deb11u1build0.22.04.1"}]}],"versions":["2.0.13-1.4build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1ubuntu0.1~esm1"}]}],"versions":["2.0.11-1","2.0.13-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1.2ubuntu0.1~esm1"}]}],"versions":["2.0.13-1.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1.4+deb11u1build0.20.04.1"}]}],"versions":["2.0.13-1.2build1","2.0.13-1.4","2.0.13-1.4build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"maradns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-1.4+deb11u1build0.22.04.1"}]}],"versions":["2.0.13-1.4build2"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"maradns","product":"maradns"},{"vendor":"samboy","product":"maradns"}],"references":[{"url":"https://github.com/samboy/MaraDNS/security/advisories/GHSA-58m7-826v-9c3c","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/samboy/MaraDNS/commit/bab062bde40b2ae8a91eecd522e84d8b993bab58","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://github.com/samboy/MaraDNS/blob/08b21ea20d80cedcb74aa8f14979ec7c61846663/dns/Decompress.c#L886","tags":["x_refsource_MISC","x_transferred","Product","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NB7LDZM5AGWC5BHHQHW6CP5OFNBBKFOQ/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00019.html","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://www.debian.org/security/2023/dsa-5441","tags":["x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31137.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31137","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-31137","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-31137","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6271-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30256","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-31137","title":"MaraDNS Integer Underflow Vulnerability in DNS Packet Decompression","description":"MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.\n\nThe vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.\n\nOne proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len \u003c= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.","status":"published","published":"2023-05-09T13:56:46.219Z","modified":"2025-02-13T16:49:46.296Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:35:27.430605Z"}],"euvd":[{"id":"EUVD-2023-35457","description":"MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.\n\nThe vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.\n\nOne proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len \u003c= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.","status":"published","published":"2023-05-09T13:56:46Z","modified":"2025-02-13T16:49:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:50.427692Z"}],"nvd":[{"id":"CVE-2023-31137","description":"MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.\n\nThe vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.\n\nOne proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len \u003c= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.","status":"published","published":"2023-05-09T14:15:13.607Z","modified":"2026-06-17T05:56:21.527Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:08:01.131774Z"}],"osv":[{"id":"CVE-2023-31137","title":"MaraDNS Integer Underflow Vulnerability in DNS Packet Decompression","description":"MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.\n\nThe vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.\n\nOne proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len \u003c= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.","status":"published","published":"2023-05-09T13:56:46.219Z","modified":"2026-10-28T10:32:55.842724025Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"DEBIAN-CVE-2023-31137","description":"MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.  The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.  One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len \u003c= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.","status":"published","published":"2023-05-09T14:15:13.607Z","modified":"2026-08-27T23:04:47.800098573Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-31137","description":"MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service. One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len \u003c= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.","status":"published","published":"2023-05-09T14:15:00Z","modified":"2026-02-04T03:55:24.955314Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"DLA-3457-1","title":"maradns - security update","status":"published","published":"2023-06-19T00:00:00Z","modified":"2026-03-09T01:19:02.374002Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5441-1","title":"maradns - security update","status":"published","published":"2023-06-29T00:00:00Z","modified":"2026-03-09T02:08:40.190626Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"USN-6271-1","title":"maradns vulnerabilities","description":"Xiang Li discovered that MaraDNS incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to obtain\nsensitive information. (CVE-2022-30256)\n\nHuascar Tejeda discovered that MaraDNS incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a denial\nof service. (CVE-2023-31137)\n","status":"published","published":"2023-08-03T11:28:01Z","modified":"2026-06-25T13:32:14.338302401Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}