EUVD-2026-24937
GHSA-7mxf-3gj9-r25x
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
6DescriptionCVE.org
PRSD detection denial of service
AnalysisAI
Denial of service in dnsdist via crafted PRSD (PowerDNS Response Detection) queries causes assertion failure and service disruption on remote DNS resolvers. The vulnerability requires specific network conditions and crafted packet construction (AC:H) but affects default configurations without authentication. CVSS 3.7 reflects low availability impact with non-trivial exploitation complexity.
Technical ContextAI
dnsdist is a DNS load balancer and traffic distributor from PowerDNS. PRSD (PowerDNS Response Detection) is a DNS protocol extension used for advanced traffic analysis and filtering. The vulnerability exists in dnsdist's PRSD packet handling logic, where malformed or specially crafted PRSD queries trigger an assertion failure in the detection engine rather than graceful error handling. This likely involves improper bounds checking or type validation in the PRSD parser when processing the detection data structure.
RemediationAI
Consult the official PowerDNS dnsdist security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html for the specific patched version number and upgrade instructions. Pending patch availability, operators can mitigate by disabling PRSD detection if not required for operations (via dnsdist configuration), implementing rate limiting on DNS queries to reduce the window for crafted packet delivery, or restricting PRSD-based traffic to trusted upstream resolvers. Note that disabling PRSD detection may impact traffic analysis and load balancing features that depend on response detection.
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
PowerDNS dnsdist allows unauthenticated DNS over HTTPS (DoH) queries to bypass access control lists when the early_acl_d
DNSdist fails to validate packet size bounds when rewriting DNS questions or responses via Lua methods (DNSQuestion:chan
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing d
Memory exhaustion in DNSdist allows remote, unauthenticated attackers to trigger denial of service by crafting malicious
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
DNSdist instances using custom Lua code can be crashed via denial of service when the DNSQuestion:getEDNSOptions method
dnsdist's Discovery of Designated Resolvers (DDR) upgrade mechanism allows a rogue backend to send a crafted SVCB respon
dnsdist can experience a denial-of-service condition through query-response mismatching when a client sends precisely ti
HTML injection in DNSdist internal web dashboard allows remote unauthenticated attackers to inject malicious content via
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today