CVE-2017-15908

In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service.

• CWE-835

• http://www.securityfocus.com/bid/101600Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039662Third Party Advisory, VDB Entry
• https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1725351Issue Tracking, Patch, Third Party Advisory
• https://github.com/systemd/systemd/pull/7184Issue Tracking, Patch, Third Party Advisory
• https://usn.ubuntu.com/3558-1/Patch, Third Party Advisory
• http://www.securityfocus.com/bid/101600Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039662Third Party Advisory, VDB Entry
• https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1725351Issue Tracking, Patch, Third Party Advisory
• https://github.com/systemd/systemd/pull/7184Issue Tracking, Patch, Third Party Advisory
• https://usn.ubuntu.com/3558-1/Patch, Third Party Advisory

Published

Oct 26, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15894Directory traversal vulnerability in the SYNO.FileStation.Ex…
• CVE-2017-15895Directory traversal vulnerability in the SYNO.FileStation.Ex…
• CVE-2017-15896Node.js was affected by OpenSSL vulnerability CVE-2017-3737 …9.1
• CVE-2017-15897Node.js had a bug in versions 8.X and 9.X which caused buffe…3.1
• CVE-2017-15906The process_open function in sftp-server.c in OpenSSH before…5.3
• CVE-2017-15907SQL injection vulnerability in phpCollab 2.5.1 and earlier a…
• CVE-2017-15909D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded …
• CVE-2017-1591IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vuln…
• CVE-2017-15911The Admin Console in Ignite Realtime Openfire Server before …
• CVE-2017-15913The Installer in Whale allows DLL hijacking.
• CVE-2017-15914Incorrect implementation of access controls allows remote us…
• CVE-2017-15917In Paessler PRTG Network Monitor 17.3.33.2830, it's possible…