Sam Trenholme’s blog

Another MaraDNS bugfix

September 1, 2026

Another patch for a very minor security bug in MaraDNS.

Bug description

Deadwood, when sending a RFC8482 reply to an ANY query, would transmit over the network 19 bytes of uninitialized memory. This is a possible (but unlikely) leak of private data. This bug was fixed on September 1, 2026, in commit cd87cfd9; a patch is available, and the Windows 32-bit binary was fixed in commit 0f46565c.

An analysis of the packets for an unpatched Deadwood in Ubuntu 26.04 show no significant information is leaked in those 19 bytes.

This bug does not merit a new MaraDNS release.

Thoughts on AI

Since this is yet another AI-assisted security report, let me discuss my feelings about AI. I am not a big fan of AI:

Environmental impact of countless datacenters being built
Sky high memory and storage prices, making computers too expensive
Jobs being replaced by AI, causing high unemployment
People using LLMs as therapists or even as girl/boyfriends
Countless security reports to trawl through, most of which are minor

I am proud, however, that no major security hole has been found with MaraDNS in the age of AI (knock on wood). It’s things like:

Denial of service of just the DNS-over-TCP part of Deadwood (which is disabled by default)
A very hard to exploit buffer overflow in a program which hasn’t even compiled since 2022
19 bytes of unallocated heap data can be transmitted over the network. To get any important information from this is nay to impossible.

How I use AI

AI isn’t entirely bad: I would rather have AI answer a question for me than try and find an answer on Stack Overflow.

Also, it’s nice to be able to generate AI summaries of articles, so I can have a local mirror of articles I link to in my blog. Indeed, the AI summaries solve a problem AI has created: Since countless web bots are now being run to train LLMs, websites have retaliated by blocking a large number of IPs. To wit, I need to use a VPN to access one of the big archiving websites out there.

That in mind, I can’t count on a web archive making some news article I link to in my blog permanent anymore; instead I now make an AI summary (to remove copyright from the article; note that this legal trick only works when the article is reporting on facts, since facts are not protected by copyright) so people can get an overview of the news I comment on in my blog.