Description

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-07-23T09:16:26.843Z",
  "pubdate": "2026-07-23T09:16:26.843Z",
  "executiveSummary": "This vulnerability involves a logic flaw in time-to-live (TTL) handling during recursive resolution when interacting with slow authoritative name servers. Specifically, the capping of TTLs is not enforced due to a lack of available data when authoritative responses are significantly delayed and cached records expire mid-process. This security issue impacts DNS resolution components responsible for processing authoritative name server records. The primary risk implication is the potential manipulation or improper caching of record lifespans, subverting standard DNS caching security controls. An attacker must be capable of causing significant latency or responding very slowly from an authoritative nameserver. Exploitation requires specific timing conditions where almost expired records are actively utilized to refresh authoritative name server records while the authoritative service exhibits extreme latency, causing internal state discrepancies and bypassing expected TTL enforcement boundaries.",
  "technicalDetails": "The root cause of the vulnerability lies in the conditional logic governing TTL capping enforcement during DNS resolution. Under normal resolution pathways, child records are evaluated deterministically: if they are unexpired, they are used immediately as valid data; if they are expired, they are discarded and not utilized. However, a distinct code path or edge case emerges when authoritative name servers respond with extreme latency. If the authentication process responds very slowly, cached records may expire midway through the transaction. In this specific scenario, the system lacks the necessary data to enforce TTL capping properly because the records transition into an expired or indeterminate state concurrently with the delayed response handling. This anomaly can only manifest when records that are nearly expired are actively leveraged to refresh authoritative NS records. Consequently, the resolution engine fails to apply the requisite bounds to the incoming TTL values due to the absence of valid context data at the critical moment of processing. An attacker capable of inducing high latency on an authoritative name server can manipulate the timing window to coincide with record expiration. The attack flow proceeds as follows: first, the resolver queries the authoritative name server, which intentionally delays its response. Second, internal records approach or reach their expiration threshold during this waiting period. Third, due to the slow response and expired state, the validation logic encounters a lack of data, skipping the mandatory TTL capping enforcement. Fourth, the system accepts the refreshed authoritative NS records without the constraints imposed by strict TTL capping rules. This technical oversight compromises the integrity of the caching mechanism, allowing unconstrained or improperly bounded TTL values to persist in the resolver cache, potentially facilitating downstream cache poisoning or record persistence attacks under highly specific network latency conditions."
}