dnsdist CVE-2026-33596

Exploitation requires the attacker to be positioned on the adjacent network (not remote), dnsdist must be configured with at least one TCP-only or DNS over TLS backend, and the attacker must be able to send query traffic to dnsdist that will be routed to the affected backend. Exploitation does not require authentication or special dnsdist configuration beyond using TCP or DoT backends. The attacker must possess precise timing control and network measurement capability to synchronize the attack. Default configurations that use UDP backends are not affected; this vulnerability only manifests when TCP or DoT protocols are in use for backend communication.

This vulnerability presents low real-world risk despite affecting a critical DNS infrastructure component. The CVSS score of 3.1 is appropriate given the conjunction of limiting factors: attack vector is adjacent-network-only (not remotely exploitable), attack complexity is high (requires precise timing), and impact is limited to availability with no confidentiality or integrity breach. Exploitation requires sophisticated network-level timing control that is difficult to achieve reliably in production environments. The absence of a CISA KEV listing, no mention of active exploitation, and no public POC in available data further indicate this is a theoretical rather than practically weaponized issue. Organizations running dnsdist should prioritize patching based on their exposure to adjacent-network attackers (data center scenarios, shared hosting) rather than immediate critical response. The tagging as 'Information Disclosure' in available data may be mislabeled given the CVSS vector shows no confidentiality impact (C:N) - the actual impact is availability.

An attacker on the same network segment as dnsdist sends a carefully timed burst of DNS queries targeting a TCP-only or DoT backend server. By synchronizing query transmission with network latency variations, the attacker causes the correlation between outbound queries and inbound responses to desynchronize, leading some responses to be incorrectly matched to different queries. This mismatch can cause subsequent legitimate queries to receive wrong answers or timeouts, degrading DNS availability for clients relying on that dnsdist instance.