A flaw in OpenStack Designate’s mDNS handler causes the service to perform pool‑blind lookups when resolving record queries and NOTIFY requests. When two DNS zones share the same name across different pools, the lookup deterministically fails, leading the handler to respond with REFUSED for every DNS query that reaches that path. An attacker can trigger this condition by sending a single unauthenticated UDP packet to the _handle_notify route, effectively denying DNS service availability for that zone configuration. The vulnerability does not disclose data or provide remote code execution; its primary impact is a denial‑of‑service for the affected zones.

Any deployment of OpenStack Designate running a version earlier than 22.0.2 is vulnerable. The issue affects both cross‑tenant zone overlaps and legitimate same‑tenant cross‑pool setups within OpenStack 21.x and older 22.0.x releases.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is 0.00509 (less than 1%), suggesting a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at the time of analysis. The likely attack vector is network‑based, requiring an unauthenticated UDP packet to the _handle_notify route. If an attacker controls a tenant or can send packets to the mDNS service, they can reverse‑engineer the deterministic failure and cause the service to return REFUSED responses for all DNS queries through that path, effectively denying DNS resolution for the affected zones.