Skip to main content

Dnsdist CVE-2026-27854

| EUVDEUVD-2026-17409 HIGH
Use After Free (CWE-416)
2026-03-31 OX GHSA-fmwh-v9r8-w9j6
Denial Of Service Use After Free Memory Corruption Dnsdist Powerdns
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Re-analysis Queued
Jul 25, 2026 - 11:22 vuln.today
cvss_changed
Severity Changed
Jul 25, 2026 - 11:22 NVD
MEDIUM HIGH
CVSS changed
Jul 25, 2026 - 11:22 NVD
4.8 (MEDIUM) 7.5 (HIGH)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 31, 2026 - 12:15 euvd
EUVD-2026-17409
Analysis Generated
Mar 31, 2026 - 12:15 vuln.today
CVE Published
Mar 31, 2026 - 12:06 nvd
MEDIUM 4.8

DescriptionNVD

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

AnalysisAI

DNSdist instances using custom Lua code can be crashed via denial of service when the DNSQuestion:getEDNSOptions method accesses a modified DNS packet, triggering a use-after-free condition. This affects DNSdist across all versions and requires network access to send crafted DNS queries, but the attack demands specific Lua code patterns and high attack complexity; no public exploit or active exploitation has been confirmed, and the real-world impact is limited to environments where custom Lua DNS query handlers reference EDNS options.

Technical ContextAI

DNSdist is PowerDNS's high-performance DNS load balancer and traffic shaper, which supports custom query processing via embedded Lua scripting. The vulnerability resides in how the DNSQuestion:getEDNSOptions Lua method handles references to EDNS (Extension Mechanisms for DNS) option data within DNS packet structures. When a DNS packet is modified during processing (for example, by upstream transformations or packet rewrites), the internal pointer or reference used by getEDNSOptions may become stale, pointing to memory that has been reallocated or freed. This is a classic use-after-free condition at the memory safety level. The root cause is insufficient validation or lifetime tracking of DNS packet structures in the Lua-to-C++ boundary when EDNS options are accessed post-modification.

RemediationAI

Update DNSdist to a patched version released by PowerDNS that addresses the use-after-free condition in the DNSQuestion:getEDNSOptions method. The exact patched version number is not provided in the available data; consult the PowerDNS advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html for the specific upgrade target. As an interim mitigation, review and audit custom Lua code to identify any calls to DNSQuestion:getEDNSOptions, and either remove them if unnecessary or refactor them to avoid relying on EDNS options after packet modifications. Restrict DNSdist to minimal or no custom Lua processing if feasible, reducing the attack surface. Consider network-level controls to limit DNS query sources to trusted clients.

More in Dnsdist

View all
CVE-2017-7557 HIGH
8.8 Aug 22

dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
CVE-2026-24028 HIGH
8.2 Mar 31

Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
CVE-2026-33593 HIGH
7.5 Apr 22

Remote denial of service in dnsdist allows unauthenticated attackers to crash the DNS load balancer by sending specially
CVE-2026-27853 HIGH
7.5 Mar 31

DNSdist fails to validate packet size bounds when rewriting DNS questions or responses via Lua methods (DNSQuestion:chan
CVE-2026-24030 HIGH
7.5 Mar 31

Memory exhaustion in DNSdist allows remote, unauthenticated attackers to trigger denial of service by crafting malicious
CVE-2026-33602 MEDIUM
6.5 Apr 22

DNSdist is vulnerable to denial of service via out-of-bounds write when processing crafted UDP responses from a rogue ba
CVE-2026-24029 MEDIUM
6.5 Mar 31

PowerDNS dnsdist allows unauthenticated DNS over HTTPS (DoH) queries to bypass access control lists when the early_acl_d
CVE-2018-14663 MEDIUM
5.9 Nov 26

An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing d
CVE-2026-33260 MEDIUM
5.3 Apr 22

Denial of service in PowerDNS Authoritative, Recursor, and dnsdist via unbounded memory allocation in their internal web
CVE-2026-33257 MEDIUM
5.3 Apr 22

Unlimited memory allocation in PowerDNS internal web server allows remote denial of service via crafted web requests. Th
CVE-2026-33595 MEDIUM
5.3 Apr 22

dnsdist allows remote denial-of-service attacks through memory exhaustion by generating numerous error responses on sing
CVE-2026-33594 MEDIUM
5.3 Apr 22

dnsdist can be forced into excessive memory allocation when a client generates high volumes of DNS queries routed to an

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Debian

dnsdist
Release Status Fixed Version Urgency
bullseye fixed (unfixed) end-of-life
bookworm fixed (unfixed) end-of-life
trixie vulnerable 1.9.10-1+deb13u1 -
forky vulnerable 2.0.2-1 -
sid fixed 2.0.3-1 -
(unstable) fixed 2.0.3-1 -

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-27854 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy