The vulnerability in Knot DNS's mod-onlinesign module affects versions prior to 3.4.10 and 3.5.4. It involves incorrect computation of the next NSEC owner name, which can create an overly broad authenticated denial interval. This allows downstream validating resolvers employing aggressive negative caching to synthesize negative DNS answers for legitimate domain names, causing denial of service at the resolver level. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

The vulnerability causes denial of service on DNS resolvers that validate DNSSEC and use aggressive negative caching. Legitimate domain names may be incorrectly treated as non-existent, disrupting DNS resolution for clients relying on affected resolvers. There is no direct impact on confidentiality or integrity of data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No temporary or official fixes are currently documented.