CVE-2026-71194: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-71194 is a denial-of-service vulnerability in OpenStack Designate's mDNS handler that allows an unauthenticated attacker to disrupt DNS resolution via a single UDP packet. The flaw was reported by Omer Schwartz of Red Hat and disclosed on August 11, 2026 as part of OSSA-2026-034, alongside the related cross-tenant zone overlap issue CVE-2026-71193. Affected versions include Designate >=1.0.0 <20.0.2, 21.0.0, and 22.0.0; version 22.0.2 and later are patched. It carries a CVSS v3.1 base score of 6.8 (Medium/High) (GitHub Advisory, OpenStack OSSA).

The root cause is classified as CWE-669 (Incorrect Resource Transfer Between Spheres): the mDNS handler performs pool-blind lookups when resolving DNS record queries and NOTIFY requests, without scoping the lookup to the correct pool. When two zones with the same name exist across different pools — whether due to cross-tenant zone overlap (as described in CVE-2026-71193) or legitimate same-tenant cross-pool configurations — the lookup fails deterministically, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify code path is directly exploitable via a single unauthenticated UDP packet sent to the mDNS service. BIND9 views do not mitigate this issue because mDNS operates as a shared service upstream of any view configuration (OpenStack OSSA, oss-security).

Successful exploitation causes the mDNS handler to return REFUSED for all DNS queries routed through the affected path, effectively disrupting DNS resolution for all zones managed by that Designate deployment. The availability impact is high and scoped beyond the vulnerable component itself (scope: Changed), meaning DNS service for multiple tenants or pools can be taken offline. There is no confidentiality or integrity impact; the attack is purely a denial-of-service. All deployments using multiple Designate pools are affected, making this particularly impactful in multi-tenant OpenStack environments (GitHub Advisory, oss-security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is network-exploitable with no authentication or user interaction required, but attack complexity is rated High because a precondition — two zones with the same name existing across different pools — must be present. This condition can be engineered by an attacker via the cross-tenant zone overlap described in CVE-2026-71193, or may exist naturally in legitimate configurations. The EPSS score is approximately 0.51%, indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog, and NVD SSVC rates exploitation as 'none' and automation as 'no' (GitHub Advisory).

1. Identify target: Locate an OpenStack Designate deployment running a vulnerable version (<20.0.2, 21.0.0, or 22.0.0) with multiple DNS pools configured and the mDNS service network-accessible.
2. Create zone collision (precondition): Exploit CVE-2026-71193 (cross-tenant zone overlap via attribute filter pool scheduling) to create a zone with the same name as an existing zone in a different pool, or identify an existing same-tenant cross-pool configuration with overlapping zone names.
3. Send malicious NOTIFY packet: Craft and send a single unauthenticated UDP DNS NOTIFY packet targeting the Designate mDNS handler's listening port (typically UDP 5354 or the configured mDNS port), referencing the colliding zone name.
4. Trigger pool-blind lookup failure: The mDNS handler's _handle_notify path performs a pool-blind lookup, encounters the ambiguous zone name across pools, and fails deterministically.
5. Achieve denial of service: The handler returns REFUSED for all subsequent DNS queries through that path, disrupting DNS resolution for all zones served by the affected mDNS handler (oss-security, GitHub Advisory).

• Network: Unexpected or repeated UDP packets to the Designate mDNS service port (typically UDP 5354) from external or untrusted sources; DNS NOTIFY requests for zone names that match zones in multiple pools.
• Logs: Designate mDNS handler logs showing repeated REFUSED responses for DNS queries; error log entries indicating pool-blind lookup failures or ambiguous zone resolution errors in the _handle_notify path.
• Service Behavior: Sudden increase in DNS REFUSED responses from the Designate mDNS service; DNS resolution failures for zones that were previously resolving correctly across multiple pools.
• Configuration Audit: Presence of zones with identical names across different Designate pools, particularly zones created by different tenants (indicative of potential CVE-2026-71193 exploitation as a precondition) (oss-security).

Upgrade OpenStack Designate to version 20.0.2 (2025.1/epoxy), 21.0.1 (2025.2/flamingo), or 22.0.2 (2026.1/gazpacho) or later, which include the official patches (oss-security). Note that stable branch patches depend on two prerequisite backports (mDNS split-horizon pool scoping, Change 998005/998006) that must be present before applying the fix. As interim workarounds: restrict network access to the mDNS handler to trusted hosts only; implement rate limiting on UDP packets to the mDNS service; and avoid configurations with overlapping zone names across different pools. Operators should also audit existing zones for cross-tenant collisions that may have been created before the fix, using the detection tool to be proposed as a separate public patch (OpenStack OSSA).

The vulnerability was disclosed by the OpenStack Vulnerability Management Team via OSSA-2026-034, crediting Tore Anderson of Redpill Linpro AS (for CVE-2026-71193) and Omer Schwartz of Red Hat (for CVE-2026-71194). The advisory was posted to the oss-security mailing list and covered by security aggregators including Tenable (Nessus plugin 338177), AUSCERT (ESB-2026.9745), and INCIBE-CERT. German Linux security outlet Pro-Linux also covered the dual Designate vulnerabilities. No significant social media controversy or broader community debate has been observed beyond standard vulnerability tracking (oss-security, OpenStack OSSA).