MaraDNS 1.0 before 1.0.41 1.2 before 1.2.12.08 and 1.3 before 1.3.07.04 allows remote attackers to cause a denial of service via a crafted DNS packet that prevents an authoritative name (CNAME) record from resolving aka \improper rotation of resource records.\