Technitium DNS Server contains a logic flaw that causes it to repeatedly request missing RRSIG records or mismatched DNSKEY records. An attacker who controls a domain can trigger these excessive queries and generate a large volume of outbound DNS traffic from the server. The result is network resource exhaustion, which effectively denies legitimate DNS request processing or degrades service availability. The weakness aligns with CWE-405 (Denial of Service) and CWE-406 (Resource Exhaustion).

All instances of Technitium DNS Server running a version earlier than 15.0 are affected. Version 15.0 introduces a fix that limits the number of DNSSEC requests issued for the same domain. Other older releases therefore retain the vulnerability and should be upgraded.

The CVSS score of 6.9 places this flaw in the moderate‑high severity range. Although EPSS data is unavailable, the lack of a KEV listing indicates that no widespread public exploits are known. Nevertheless, the attack vector is straightforward: the attacker only needs to control a domain that the server will query. Once the DNS record is propagated, the server will continuously send DNSSEC requests until internal limits are reached, providing a reliable denial‑of‑service mechanism.