Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-40719

Quick assessment

Affected

MaraDNS MaraDNS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MaraDNS是Sam Trenholme个人开发者的一种开源域名系统实现，可以用作缓存，递归或权威名称服务器。 MaraDNS 3.5.0036版本存在安全漏洞，该漏洞源于无法解析权威域名服务器地址的域可能导致连接槽耗尽。

CVSS 7.5 · High EPSS 0.38% · P31 Updated Apr 18, 2026

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-40719

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

Deadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone whose authoritative nameserver address cannot be resolved.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

控制流实现总是不正确

Source: CVE Program / CVE List V5

Vulnerability Title

MaraDNS 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MaraDNS	MaraDNS	3.5.0036	-

II. Public POCs for CVE-2026-40719

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-40719

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-40719 (1)

🔗 Deadwood (MaraDNS 3.5.0036) Applies Full Fixed-Interval Retry Period to Any Unresolvable Nameserver, Exhausting Upstream Connection Slots and Causing Resolver Unavailability · Advisory · samboy/MaraDNS · GitHub Read full article

https://www.cve.org/CVERecord?id=CVE-2026-40719

IV. Related Vulnerabilities

Same product: MaraDNS

CVE-2023-31137
MaraDNS Integer Underflow Vulnerability in DNS Packet Decomp

Same weakness: CWE-670