Dnsdist CVE-2026-24028

The CVSS score of 5.3 reflects a medium-severity vulnerability with a low availability impact (A:L) and no confidentiality or integrity impact in the base vector. However, the vulnerability permits two distinct attack outcomes: denial of service through crash triggering, and information disclosure through unrelated memory access. The attack vector is network-based (AV:N) with low complexity (AC:L) and requires no authentication (PR:N), making it relatively easy to exploit. The real-world risk is elevated because this vulnerability only affects deployments using custom Lua code with newDNSPacketOverlay, potentially narrowing exposure, but attackers who send malformed DNS responses can reliably trigger the condition. No EPSS score or KEV status was provided, but the public advisory and disclosed attack mechanism suggest this is a known, reproducible vulnerability requiring prompt patching in affected environments.

An attacker on the network sends a crafted DNS response packet to a dnsdist instance running custom Lua code that parses packets with newDNSPacketOverlay. The malformed packet contains length or offset values designed to cause the parser to read beyond the packet buffer. The out-of-bounds read either crashes the dnsdist process (denial of service) or leaks sensitive data from adjacent memory regions back to the attacker. This attack requires no authentication and can be repeated to achieve reliable service disruption or information gathering.