A flaw in OpenStack Designate’s mDNS handler causes the service to perform pool‑blind lookups when resolving record queries and NOTIFY requests. When two DNS zones share the same name across different pools, the lookup deterministically fails, leading the handler to respond with REFUSED for every DNS query that reaches that path. An attacker can trigger this condition by sending a single unauthenticated UDP packet to the _handle_notify route, effectively denying DNS service availability for that zone configuration. The vulnerability does not disclose data or provide remote code execution; its primary impact is a denial of DNS resolution for affected zones.

Any deployment of OpenStack Designate running a version earlier than 22.0.2 is vulnerable. The issue affects both cross‑tenant zone overlaps and legitimate same‑tenant cross‑pool setups within OpenStack 21.x and older 22.0.x releases.

The CVSS score of 6.8 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation at the time of analysis. The attack vector is network‑based, requiring an unauthenticated UDP packet to the mDNS _handle_notify endpoint. If an attacker controls a tenant or can send packets to the mDNS service, they can permanently disrupt DNS resolution for zones with overlapping names, resulting in a denial‑of‑service that affects all clients relying on those DNS records.