Dnsdist CVE-2026-27854

The CVSS score of 4.8 reflects the limited but real nature of this threat: network accessibility without authentication (AV:N, PR:N), high attack complexity (AC:H), and dual impact categories (one bit of confidentiality and one bit of availability). The EPSS probability and KEV status were not provided in the input data, but the attack complexity requirement and requirement for custom Lua code patterns significantly reduce real-world exploitability. This is not a trivial remote code execution or trivial denial of service; it is a memory safety issue that requires both (1) the target to have custom Lua code using the vulnerable getEDNSOptions method, and (2) the attacker to craft DNS queries that trigger packet modification in a way that invalidates the EDNS option reference. Organizations using DNSdist in default or minimal-Lua configurations face lower risk than those with complex custom Lua query handlers. The confidentiality leak (L:C) suggests potential unintended memory disclosure alongside the denial-of-service impact.

An attacker with network access to a DNSdist instance sends a series of crafted DNS queries designed to trigger packet modification within the DNSdist processing pipeline (for example, via rate-limiting rules, packet rewriting rules, or upstream proxy transformations). If the custom Lua code simultaneously calls DNSQuestion:getEDNSOptions on the modified packet, the method accesses freed or reallocated memory, causing an access violation that crashes the DNSdist process. The attacker can repeat this attack to sustain denial of service against the DNS service. No public proof-of-concept exploit has been identified at the time of analysis.