{"id":"CVE-2026-71194","aliases":["DEBIAN-CVE-2026-71194","EUVD-2026-57692","GHSA-r7xh-5qq7-jh72","UBUNTU-CVE-2026-71194"],"status":"published","title":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving...","description":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00515,"percentile":0.4436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-669"],"published":"2026-08-12T22:23:46Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"Debian:12","package":"designate","fixed_in":["1:15.0.2-0+deb11u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"designate","fixed_in":["1:20.0.0-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"designate","fixed_in":["1:22.0.0-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.0.2-0+deb11u1"}]}],"versions":["1:15.0.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.0.0-2+deb13u1"}]}],"versions":["1:20.0.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.0.0-2"}]}],"versions":["1:20.0.0-2","1:21.0.0-1","1:21.0.0-2","1:21.0.0~rc1-1","1:21.0.0~rc1-2","1:21.0.0~rc1-3","1:21.0.0~rc1-4","1:22.0.0-1","1:22.0.0~rc1-1","1:22.0.0~rc1-2","1:22.0.0~rc1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.0.0-0ubuntu1","1:2.0.0~b1-0ubuntu1","1:2.0.0~b2-0ubuntu1","1:2.0.0~b2-0ubuntu2","1:2.0.0~b3-0ubuntu1","1:2.0.0~b3-0ubuntu2","1:2.0.0~rc1-0ubuntu1","1:2.0.0-0ubuntu1","1:2.1.0-0ubuntu1","1:2.1.0-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b1-0ubuntu2","1:6.0.0~b2-0ubuntu1","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.1-0ubuntu1","1:6.0.1-0ubuntu1.2","1:6.0.1-0ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b1~git2019121610.cdac0fc2-0ubuntu1","1:10.0.0~b1~git2019121610.cdac0fc2-0ubuntu2","1:10.0.0~b2~git2020021416.8b5ec128-0ubuntu2","1:10.0.0~b3~git2020032414.dd359ba3-0ubuntu1","1:10.0.0~b3~git2020041012.9ed2623a-0ubuntu1","1:10.0.0-0ubuntu0.20.04.1","1:10.0.1-0ubuntu1","1:10.0.2-0ubuntu1","1:10.0.2-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.0.0-0ubuntu1","1:13.0.0+git2021120810.aa798fc0-0ubuntu1","1:13.0.0+git2022011215.bff3d5f6-0ubuntu1","1:13.0.0+git2022030310.8ce022a7-0ubuntu1","1:14.0.0-0ubuntu1","1:14.0.1-0ubuntu1","1:14.0.2-0ubuntu1","1:14.0.3-0ubuntu1","1:14.0.4-0ubuntu1","1:14.0.4-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.0.0-0ubuntu2","1:17.0.1+git2023121308.d90691f3-0ubuntu1","1:17.0.1+git2024011916.002005a4-0ubuntu2","1:18.0.0~rc1-0ubuntu1","1:18.0.0-0ubuntu1","1:18.0.0-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:22.0.0-0ubuntu2","1:22.0.0+git20260814.66.9f82089-0ubuntu1","1:23.0.0~rc1-0ubuntu2","1:23.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:21.0.0-0ubuntu1","1:21.0.0-0ubuntu2","1:21.0.0+git20260121.19.145042f4-0ubuntu1","1:22.0.0~rc1-0ubuntu1","1:22.0.0-0ubuntu1","1:22.0.0-0ubuntu2","1:22.0.0-0ubuntu2.1"]}],"products":[{"vendor":"openstack","product":"designate"},{"vendor":"red hat","product":"designate"}],"references":[{"url":"https://launchpad.net/bugs/2160533","tags":["issue-tracking","report"]},{"url":"https://security.openstack.org/ossa/OSSA-2026-034.html","tags":["vendor-advisory","advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/11/6","tags":["issue-tracking","vendor-advisory","mailing-list","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71194","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r7xh-5qq7-jh72"},{"url":"https://opendev.org/openstack/designate","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71194.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-71194","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-71194","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71194","tags":["report"]},{"url":"https://bugs.launchpad.net/designate/+bug/2160533","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-71194","description":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.","status":"published","published":"2026-08-12T22:23:46.951Z","modified":"2026-08-13T13:32:41.548Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-57692","description":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.","status":"published","published":"2026-08-12T22:23:46Z","modified":"2026-08-13T13:32:41Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:56.761721Z"}],"ghsa":[{"id":"GHSA-r7xh-5qq7-jh72","title":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving...","description":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.","status":"published","published":"2026-08-13T00:31:28Z","modified":"2026-08-13T00:31:36Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T15:10:24.70819Z"}],"nvd":[{"id":"CVE-2026-71194","description":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.","status":"published","published":"2026-08-12T23:17:22.17Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-71194","description":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.","status":"published","published":"2026-08-12T22:23:46.951Z","modified":"2026-10-28T02:31:06.550456446Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-71194","description":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.","status":"published","published":"2026-08-12T23:17:22.17Z","modified":"2026-10-25T09:47:32.299014245Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"UBUNTU-CVE-2026-71194","description":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.","status":"published","published":"2026-08-12T23:17:00Z","modified":"2026-10-17T13:00:42.224404326Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:03.035847Z"}]}}