CVE-2018-17419: Denial of service in github.com/miekg/dns
Summary
CVE-2018-17419: Denial of service via malformed zone file in github.com/miekg/dns. Affects github.com/miekg/dns versions < 1.0.10. Fixed in 1.0.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/miekg/dns is a Go library that provides DNS functionality, including parsing and generating DNS messages. It is widely used in Go applications for DNS-related operations. However, a vulnerability has been discovered in the package that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability (CVE-2018-17419) in github.com/miekg/dns is due to a nil pointer dereference when parsing a malformed zone file containing TA (Trust Anchor) records. This can be exploited by an attacker to cause a panic, resulting in a DoS condition. If an application parses user-supplied input using this package, it becomes a potential vector for a DoS attack. The impact of this vulnerability is the unavailability of DNS services, which can disrupt the normal functioning of affected systems.
How To Fix
Latest published version: v1.1.73 as of 23 Oct 2026
go get github.com/miekg/dns@v1.1.73Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.10
This is the first release that contains the fix.
go get github.com/miekg/dns@v1.0.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
The vulnerability (CVE-2018-17419) in the github.com/miekg/dns package can lead to a denial of service (DoS) condition. It is recommended to update the package to version 1.0.10 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/miekg/dns →
FAQ
The impact of this vulnerability is a denial of service (DoS) condition, leading to the unavailability of DNS services.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to update the package to the fixed version.
Yes, this vulnerability can be exploited remotely if an application parses user-supplied input using the vulnerable package.
There are no known public exploits available for this vulnerability at the time of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/miekg/dns.
