EUVD-2026-24935Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend.
AnalysisAI
dnsdist can experience a denial-of-service condition through query-response mismatching when a client sends precisely timed floods of queries routed to TCP-only or DNS over TLS backends. An adjacent network attacker with high timing precision can cause limited availability impact by desynchronizing the query-response correlation on affected backends, though exploitation requires favorable network conditions and careful query timing. This issue carries a low CVSS score (3.1) reflecting the high attack complexity and adjacency requirement.
Technical ContextAI
dnsdist is a DNS load balancer and distribution tool that routes queries to backend DNS servers. The vulnerability involves the internal query-response matching mechanism used by dnsdist when forwarding queries over TCP or DNS over TLS (DoT) protocols. The root cause relates to how dnsdist correlates outbound queries with received responses when backend connections operate in these protocols, which maintain persistent connections but require explicit matching of queries to responses. An attacker positioned on the network adjacency can exploit timing-dependent race conditions to induce misalignment between sent queries and received answers, causing responses to be associated with incorrect original queries.
RemediationAI
Upgrade dnsdist to the patched version specified in the PowerDNS advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html. If immediate patching is not possible, operators can reduce risk by implementing network-level controls to restrict access to dnsdist from untrusted adjacent networks, limiting concurrent query rates, or disabling TCP-only and DNS over TLS backend routes if they are not essential to operations. Note that disabling these backend protocols may reduce redundancy or encryption protections, so this trade-off should be evaluated against the organization's DNS resilience requirements. Prioritize patching for dnsdist instances that handle traffic from less-trusted network segments.
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
Remote denial of service in dnsdist allows unauthenticated attackers to crash the DNS load balancer by sending specially
DNSdist fails to validate packet size bounds when rewriting DNS questions or responses via Lua methods (DNSQuestion:chan
Memory exhaustion in DNSdist allows remote, unauthenticated attackers to trigger denial of service by crafting malicious
DNSdist instances using custom Lua code can be crashed via denial of service when the DNSQuestion:getEDNSOptions method
DNSdist is vulnerable to denial of service via out-of-bounds write when processing crafted UDP responses from a rogue ba
PowerDNS dnsdist allows unauthenticated DNS over HTTPS (DoH) queries to bypass access control lists when the early_acl_d
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing d
Denial of service in PowerDNS Authoritative, Recursor, and dnsdist via unbounded memory allocation in their internal web
Unlimited memory allocation in PowerDNS internal web server allows remote denial of service via crafted web requests. Th
dnsdist allows remote denial-of-service attacks through memory exhaustion by generating numerous error responses on sing
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today