A heap-based out-of-bounds read vulnerability in rldns version 1.3 poses a critical risk of service disruption for affected DNS infrastructure.

This vulnerability is a heap-based out-of-bounds read (CWE-125) triggered by an unauthenticated attacker via a specially crafted network request. The flaw resides in the processing logic of the rldns server, allowing for a crash or denial of service condition.

The vulnerability carries a CVSS score of 7.5, indicating a high severity due to the lack of required privileges and the potential for total loss of DNS availability. Successful exploitation would result in significant operational downtime for network services relying on the affected rldns instance, potentially impacting business continuity and user access to internal or external resources.

Immediate Action: Upgrade the rldns server software to version 1.4 or higher immediately to apply the vendor provided patch.

Proactive Monitoring: Review system logs for unusual DNS traffic patterns or repeated server restarts that may indicate attempted exploitation.

Compensating Controls: Deploy a network firewall or intrusion detection system to monitor and drop malformed DNS packets that match the known exploit pattern.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the high impact on service availability and the availability of a public proof-of-concept, organizations running rldns version 1.3 must prioritize this update. Applying the patch to version 1.4 is the only definitive way to resolve this vulnerability and prevent potential denial-of-service attacks.