trust-dns vulnerable to Remote Attackers causing Denial-of-Service (packet loops) with crafted DNS packets

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

not scored

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

trust-dns and trust-dns-server are vulnerable to remotely triggered denial-of-service attacks, consuming both network and CPU resources. DNS messages with the QR=1 bit set are responded to with a FormErr response. This allows creating a traffic loop, in which these FormErr responses are sent nonstop between vulnerable servers. There are two scenarios how this can be exploited: 1) Create a loop between two instances of trust-dns, consuming network resources, or 2) consuming the CPU of a single instance. With two instances A and B an attacker sends a DNS query with a spoofed source IP address to A. A replies with a FormErr to B. Now both servers with ping-pong the message back and forth until by chance the packet is dropped in the network. Multiple spoofed packets can be sent by the attacker, increasing resource consumption. A single server can get locked up replying to itself. Same setup as above, but now A sends the reply to itself. The packet is sent out as fast as the CPU and…

Published by the source

6 Jun 2023, 02:06 UTC

Last modified by the source

6 Jun 2023, 02:06 UTC

Source last checked

26 Oct 2026, 15:33 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-5fm9-h728-fwpj

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-5fm9-h728-fwpj

Advisory: trust-dns vulnerable to Remote Attackers causing Denial-of-Service (packet loops) with crafted DNS packets
IDs: GHSA-5fm9-h728-fwpj
Record: https://patchnext.com/advisories/ghsa-5fm9-h728-fwpj (revision 1, source checked 26 Oct 2026, 15:33 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Unrated
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: trust-dns-server 0.23.0-alpha.3, 0.22.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- crates.io trust-dns-server: affected < 0.22.1; >= 0.23.0-alpha.2, < 0.23.0-alpha.3; fixed in 0.22.1, 0.23.0-alpha.3

## Suggested inspection (read-only)
- crates.io trust-dns-server: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on trust-dns-server.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-5fm9-h728-fwpj (GitHub-reviewed advisory GHSA-5fm9-h728-fwpj lists affected ranges: crates.io trust-dns-server >=0 =0.23.0-alpha.2 <0.23.0-alpha.3)

Commands are suggestions: review each one before running it.