Junglewise Threat Intelligence

CVE-2025-50334: Technitium DNS Server denial of service in rate-limiting component

CVE-2025-50334 · Severity: high · CVSS 7.5 · Published 2026-01-08

Executive brief

Technitium DNS Server, a tool used for managing internet domain name requests, contains a flaw in how it limits incoming traffic. An attacker can exploit this to trick the server into blocking legitimate users from entire network blocks (subnets). This results in a denial of service, preventing users from accessing websites or services that rely on that DNS server.

Technical details

A denial of service (DoS) vulnerability exists in Technitium DNS Server (up to version 13.6) within its rate-limiting component. The vulnerability, classified as CWE-770, allows a remote, unauthenticated attacker to spoof source IP addresses to trigger rate-limiting thresholds. Because the server applies these limits across entire IPv4 /24 or IPv6 /56 subnets, an attacker can effectively blacklist legitimate traffic from those subnets. This affects the software in both recursive resolver and authoritative name server configurations. The issue is resolved in version 14.0, which introduces a redesigned rate-limiting implementation.

Affected products

  • Technitium DNS Server up to and including 13.6

Timeline

  • 2025-11-08: disclosed: Vulnerability reported to vendor by researchers from Tsinghua University.
  • 2026-01-08: advisory: CVE published and NVD record created.
  • 2026-01-08: patched: Fix released in version 14.0.

References