Skip to main content

Dnsdist CVE-2026-0396

| EUVDEUVD-2026-17361 LOW
Basic XSS (CWE-80)
2026-03-31 OX
XSS Dnsdist
3.1
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.1 LOW
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
SUSE
LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 31, 2026 - 12:15 euvd
EUVD-2026-17361
Analysis Generated
Mar 31, 2026 - 12:15 vuln.today
CVE Published
Mar 31, 2026 - 11:50 nvd
LOW 3.1

DescriptionCVE.org

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

AnalysisAI

HTML injection in DNSdist internal web dashboard allows remote unauthenticated attackers to inject malicious content via crafted DNS queries when domain-based dynamic rules are enabled, requiring user interaction to exploit. This affects all DNSdist versions with vulnerable rule functionality and carries low integrity impact with no confidentiality or availability consequences.

Technical ContextAI

DNSdist is PowerDNS's high-performance DNS load balancer and security appliance. The vulnerability stems from insufficient input validation in the DynBlockRulesGroup functionality, specifically the setSuffixMatchRule and setSuffixMatchRuleFFI methods, which process DNS query data that is subsequently reflected into the internal web dashboard without proper HTML escaping. This allows attackers to inject arbitrary HTML/JavaScript content. The root cause is a classic input validation failure (CWE category: Improper Neutralization of Input During Web Page Generation) where DNS query parameters derived from attacker-controlled sources are rendered into a web interface without sanitization. The CPE cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:* indicates all DNSdist versions are potentially affected when dynamic rules are configured.

RemediationAI

Apply the security update released by PowerDNS in response to this advisory-consult https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html for the specific patched version number and upgrade procedures. As an interim mitigation, disable domain-based dynamic rules (DynBlockRulesGroup:setSuffixMatchRule and DynBlockRulesGroup:setSuffixMatchRuleFFI) if they are not essential to your deployment, or restrict access to the internal web dashboard to trusted networks only. Input validation improvements in the patched version will sanitize DNS-derived data before rendering in the dashboard.

More in Dnsdist

View all
CVE-2017-7557 HIGH
8.8 Aug 22

dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
CVE-2026-24029 MEDIUM
6.5 Mar 31

PowerDNS dnsdist allows unauthenticated DNS over HTTPS (DoH) queries to bypass access control lists when the early_acl_d
CVE-2026-27853 MEDIUM
5.9 Mar 31

DNSdist fails to validate packet size bounds when rewriting DNS questions or responses via Lua methods (DNSQuestion:chan
CVE-2018-14663 MEDIUM
5.9 Nov 26

An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing d
CVE-2026-24030 MEDIUM
5.3 Mar 31

Memory exhaustion in DNSdist allows remote, unauthenticated attackers to trigger denial of service by crafting malicious
CVE-2026-24028 MEDIUM
5.3 Mar 31

Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
CVE-2026-27854 MEDIUM
4.8 Mar 31

DNSdist instances using custom Lua code can be crashed via denial of service when the DNSQuestion:getEDNSOptions method

CVE-2026-33597 LOW
3.7 Apr 22

Denial of service in dnsdist via crafted PRSD (PowerDNS Response Detection) queries causes assertion failure and service
CVE-2026-33599 LOW
3.1 Apr 22

dnsdist's Discovery of Designated Resolvers (DDR) upgrade mechanism allows a rogue backend to send a crafted SVCB respon
CVE-2026-33596 LOW
3.1 Apr 22

dnsdist can experience a denial-of-service condition through query-response mismatching when a client sends precisely ti

Same weakness CWE-80 – Basic XSS

View all
CVE-2025-30210 HIGH POC
8.7
CVE-2025-30161 HIGH POC
8.4
CVE-2024-32484 HIGH POC
8.2
CVE-2026-2995 HIGH POC
7.7
CVE-2024-25639 HIGH POC
7.5
CVE-2022-0989 HIGH POC
7.5
CVE-2024-34507 HIGH POC
7.4
CVE-2024-33423 HIGH POC
7.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Vendor StatusVendor

Debian

dnsdist
Release Status Fixed Version Urgency
bullseye fixed (unfixed) end-of-life
bookworm fixed (unfixed) end-of-life
trixie vulnerable 1.9.10-1+deb13u1 -
forky vulnerable 2.0.2-1 -
sid fixed 2.0.3-1 -
(unstable) fixed 2.0.3-1 -

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-0396 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy