CVE-2023-28456

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Technitium through 11.0.2. It enables attackers to launch amplification attacks (3 times more than other "golden model" software like BIND) and cause potential DoS.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-406

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
technitium	dns_server	<= 11.0.2

References

https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3Third Party Advisory
https://technitium.com/dns/Product

Timeline

Published: Sep 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-284577.5An issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and inject fake responses CVE-2023-284584.3pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the st CVE-2023-284596.5pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents th CVE-2023-28469.1Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote una CVE-2023-284607.2A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging i CVE-2023-284619.8Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SS CVE-2023-284629.8A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and CVE-2023-284647.8hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) becaus CVE-2023-284657.5The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to cer CVE-2023-284667.0do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a result CVE-2023-284676.1In MyBB before 1.8.34, there is XSS in the User CP module via the user email field.CVE-2023-284686.5An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module expos