Dnsdist CVE-2026-27853

This vulnerability presents a moderate real-world risk despite the 5.9 CVSS score. The attack vector is network-based and requires no authentication (PR:N), but exploitation requires high attack complexity (AC:H), likely due to the need to craft specific DNS responses that trigger problematic name rewriting in the target's Lua rules. The CVSS vector confirms unauthenticated remote access (AV:N, PR:N, UI:N) with high impact on availability (A:H), but no confidentiality or integrity impact. The primary concern is denial of service via forced restarts. However, real-world risk depends on whether the target deployment actively uses the vulnerable Lua methods (DNSQuestion:changeName or DNSResponse:changeName) in custom rules; default configurations without custom Lua code are not affected. No EPSS score, KEV status, or POC availability was provided in the input data, so the likelihood of active exploitation cannot be definitively assessed. Organizations should prioritize this based on whether they implement custom Lua DNS rewriting logic.

An attacker sends a series of crafted DNS responses to a DNSdist instance configured with custom Lua rules that rewrite DNS question or response names (e.g., DNS query manipulation for load balancing or filtering). The attacker carefully constructs the DNS response such that when the DNSdist Lua script processes it via DNSQuestion:changeName or DNSResponse:changeName, the name rewrite operation expands the packet beyond 65535 bytes, triggering an out-of-bounds write in the packet serialization code. This causes DNSdist to crash, interrupting DNS service until the process is restarted. The attacker can repeat this attack to maintain a denial of service condition. No public exploit code has been identified, and successful exploitation requires knowledge of the target's specific Lua configuration and the ability to send DNS traffic to the DNSdist instance.