# CVE-2026-36478: Technitium DNS Server denial of service in DnsClient

Source: https://junglewise.ai/threats/cve-2026-36478-technitium-dns-server-denial-of-service-in-dnsclient  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-36478 · Severity: info · CVSS 7.5 · Published 2026-06-26

Technitium DNS Server is an open-source tool used for self-hosting DNS services to improve privacy and security. A vulnerability in versions 14.3 and earlier allows a remote attacker to crash the server or make it unresponsive. This could lead to a total loss of DNS services for the network, preventing users from accessing websites or internal resources.

## Quick answers

**Is CVE-2026-36478 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36478 being exploited in the wild.

**How severe is CVE-2026-36478?** Informational severity, with a CVSS score of 7.5, published 26 June 2026.

**Which products and versions are affected?** Technitium DNS Server v14.3 and earlier.

**Is there a fix for CVE-2026-36478?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36478 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-36478?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service (DoS) vulnerability exists in Technitium DNS Server versions 14.3 and prior. The flaw is located within the DnsServerApp.exe, DnsServerApp.dll, and the TechnitiumLibrary.Net/Dns/DnsClient.cs components. A remote, unauthenticated attacker can exploit this issue via the network to cause the DNS service to become unavailable. While specific exploitation details are not provided in the advisory, the affected components suggest the issue may be triggered during the processing of DNS queries or client requests. Users should upgrade to a newer version (such as v15.x) to mitigate this risk.

## Affected products

- Technitium DNS Server v14.3 and earlier

## Timeline

- 2026-06-26: disclosed: CVE-2026-36478 published

## References

- [http://technitium.com/](http://technitium.com/)
- [https://github.com/TechnitiumSoftware/DnsServer/blob/aa9044d4df9d739b6a6e428bb77cecb3356b775b/CHANGELOG.md?plain=1](https://github.com/TechnitiumSoftware/DnsServer/blob/aa9044d4df9d739b6a6e428bb77cecb3356b775b/CHANGELOG.md?plain=1)