Deadwood in MaraDNS version 3.5.0036 enables attackers to send DNS queries that exhaust the server’s connection slots when the zone references an authoritative nameserver that cannot be resolved. This resource‑exhaustion flaw leads to a denial of service, preventing legitimate clients from resolving queries. The weakness maps to CWE‑670, reflecting improper limiting of a resource or race condition in handling unresolved zones.

The vulnerability affects installations of MaraDNS 3.5.0036. Any derivative or older deployments that have not applied the subsequent fix listed in the changelog are also impacted.

With a CVSS score of 7.5 the flaw is classified as high severity. No EPSS data is available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is remote DNS traffic; an attacker must have network reachability to the MaraDNS server and can trigger the condition by querying a zone whose authoritative nameserver address is unresolvable. The exploit consumes a limited pool of connection slots, ultimately degrading service availability for all clients.