CVE-2026-40719 is incorrectly labled as a "high" impact security
bug.  It's actually a "low" impact security bug.

This patch is not applied to MaraDNS by default.  People who need to
have MaraDNS be "immune" to the CVE-2026-40719 bug can apply this patch,
but please note this patch just simply disables full recursion (Deadwood
still functions as a downstream cache, its default configuration).

Here is the bug: Because of Deadwood's design, which includes a tiny
recursive resolver, it's possible to temporarily disable it with a 
flooding attack: If an IP *authorized to make recursive queries* sends
hundreds of specially crafted packets to Deadwood, it's possible to
make Deadwood's recursive resolver unresponsive for about one minute.

After a minute, Deadwood functions normally again.  This attack does
*not* allow the user access to the system running Deadwood not does it
allow an attacker to permanently disable Deadwood.

To minimize the impact of this bug, instead of applying this patch,
one can instead:

* Make sure only trusted IPs are allowed to use recursion.  If
  recursive_acl is something like "192.168.0.0/24", only computers
  in one's local LAN can perform this attack.
* Increase maxprocs.  If "maxprocs" has a value of, say, 4000000,
  the attacker will have to send millions of packets every minute to
  knock out Deadwood's recursion.  Note that increasing maxprocs
  increases Deadwood's memory usage: A maxprocs value of 4000000 has 
  a 64-bit compile of Deadwood use over 300 megabytes of memory.

To update the recursive resolver to not be vulnerable to this bug is
non-trivial.  If I'm going to redesign the recursive resolver to not
be vulnerable to those kinds of attacks, there are a lot of other things
the recursive resolver could also use:

* IPv6 support
* EDNS support (some names can only be resolved by groking EDNS packets)
* DNSSEC support
* Bug-for-bug identical to BIND 9’s recursive resolver

Since this is non-trivial to implement, and since no one is paying me
(or offering to spend tokens here in 2026) to do this work, the only
way to have Deadwood be immune to this attack is to disable recursion.

This patch disables recursion; Deadwood will refuse to start should
recursion be enabled.  To be a downstream cache instead of a recursive
resolver:

* Comment out or remove any lines with `root_servers` in one’s dwood3rc file
* Add this line: `upstream_servers["."] = "9.9.9.9, 149.112.112.112"` to
  the dwood3rc file

Note that, in Deadwood, if neither `root_servers` nor 
`upstream_servers` is set, Deadwood will use 9.9.9.9 and 149.112.112.122
as upstream servers.  I have gotten consent from the administrators
at https://quad9.net to use their servers as Deadwood’s default 
upstream name servers.

Note also that the patch is designed to have it be easy to edit
the Deadwood binary to enable recursion again:  Replace the string
"RECURSION: DISABLED" with something like "RECURSION: ENABLED ",
"RECURSION: YESYESYY", or even just "RECURSION: YISABLED" (it's important
the resulting string is the same size).

--- deadwood-github/src/DwSocket.c.orig	2026-10-08 07:17:06.961067700 -0600
+++ deadwood-github/src/DwSocket.c	2026-10-08 07:29:26.962132200 -0600
@@ -84,6 +84,9 @@
 int num_retries = 5;
 dwd_dict *blocklist_dict = 0;
 
+char *cve2026_40719 = "RECURSION: DISABLED";
+                     /*012345678901*/
+
 #ifdef MINGW
 u_long dont_block = 0;
 #endif /* MINGW */
@@ -545,6 +548,12 @@
                 s = dwm_dict_fetch(param,r);
                 q = dw_dnsname_convert(r);
                 ns_refer = dwx_ns_convert(s,is_upstream,q);
+                if(a == 0 && cve2026_40719[0] == 'R' &&
+                   cve2026_40719[11] == 'D' && is_upstream == 0) {
+                        dw_fatal(
+"Recursion disabled to have strict no CVE compliance. See \n"
+"https://samboy.github.io/MaraDNS/patches/MaraDNS-CVE-2026-40719.patch.txt");
+                }
                 if(q == 0 || ns_refer == 0 || ns_refer->len < 4) {
                         dw_log_dwstr_str(bad,r,"\"]",0);
                         dw_fatal("Please fix this line");