CVE-2026-42255
CVE-2026-42255 is a high-severity vulnerability in Technitium Dnsserver with a CVSS 3.x base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-684.
Key facts
- Severity: High (CVSS 3.x base score 7.2)
- EPSS exploit prediction: 0% (11th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-25688
- Weakness: CWE-684
- Affected product: Technitium Dnsserver
- Published:
- Last modified:
Description
Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.
Frequently asked questions
- What is CVE-2026-42255?
- Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.
- How severe is CVE-2026-42255?
- CVE-2026-42255 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.
- Is CVE-2026-42255 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-42255?
- CVE-2026-42255 affects Technitium Dnsserver. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-42255?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-42255 have an EU (EUVD) identifier?
- Yes. CVE-2026-42255 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-25688.
- When was CVE-2026-42255 published?
- CVE-2026-42255 was published on 2026-04-26 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:technitium:dnsserver:*:*:*:*:*:*:*:*
More vulnerabilities in Technitium Dnsserver
- CVE-2025-50334 — High (CVSS 7.5): An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting…
- CVE-2024-56089 — High (CVSS 7.5): An issue in Technitium through v13.2.2 enables attackers to conduct a DNS cache poisoning attack and inject fake…
- CVE-2023-49203 — High (CVSS 7.5): Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb…
- CVE-2023-28457 — High (CVSS 7.5): An issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and…
- CVE-2023-28456 — High (CVSS 7.5): An issue was discovered in Technitium through 11.0.2. It enables attackers to launch amplification attacks (3 times…
- CVE-2023-28455 — High (CVSS 7.5): An issue was discovered in Technitium through 11.0.2. The forwarding mode enables attackers to create a query loop…
All CVEs affecting Technitium Dnsserver →
Other CWE-684 vulnerabilities
- CVE-2024-50357 — Critical (CVSS 9.8): FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in…
- CVE-2024-6425 — Critical (CVSS 9.1): Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote…
- CVE-2023-24845 — Critical (CVSS 9.1): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM…
- CVE-2023-4258 — High (CVSS 8.6): In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be…
- CVE-2025-66384 — High (CVSS 8.2): app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity,…
- CVE-2025-58325 — High (CVSS 8.2): An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5…