HPE NonStop DNS: Denial of Service via improper input handling

Summary

HPE NonStop DNS 9.2.3 (Non Secure Version) contains a vulnerability classified as CWE-115 (misinterpretation of input) that can lead to a Denial of Service. The CVE record rates it with CVSS 3.1 8.2 and a network attack vector without authentication, while the HPE bulletin describes the impact as local. The attack vector is therefore uncertain and should be verified against the HPE advisory. The product is a specialist platform, mainly used by large enterprises.

Affected

• HPE NonStop DNS 9.2.3 Non Secure Version, T0685L01^BAE and earlier (per CVE record; verify in HPE bulletin)

Fixed in

• Unknown. Check the product table in HPE security bulletin HPESBNS05148 rev.1 or ask HPE support.

Workaround

• Unknown. No vendor-stated workaround found.
• Restrict DNS access to trusted networks until patched.

Exploitation

• CISA KEV: No.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
• No public proof-of-concept known; VulDB reports no exploit exists.
• No evidence of exploitation in the wild found.

Our recommendation

• Ask clients whether they run HPE NonStop DNS; if not, no action needed.
• If affected, apply HPE's fix from bulletin HPESBNS05148 as soon as the fixed version is confirmed.
• Until patched, limit DNS access to trusted networks and monitor for service outages.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE security bulletin HPESBNS05148 support.hpe.com
• VulDB entry 419812 vuldb.com
• Strix CVE-2026-73798 www.strix.ai
• threatint CVE-2026-73798 cve.threatint.com
• Canadian Centre for Cyber Security AV26-1046 www.cyber.gc.ca

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:26.