dnsdist CVE-2026-33597

PRSD detection must be enabled in dnsdist configuration (non-default feature may vary). Attack requires network access to the dnsdist resolver endpoint (AV:N). The high attack complexity (AC:H) indicates the attacker must craft packets with specific malformed PRSD data structures or satisfy particular environmental conditions such as specific protocol states, packet ordering, or timing constraints. No authentication is required. Standard dnsdist deployments may not be vulnerable if PRSD detection is not explicitly configured.

CVSS 3.7 (AV:N/AC:H/PR:N/UI:N) indicates network-accessible but non-trivial exploitation requiring specific conditions (AC:H suggests complex packet construction or environmental prerequisites). The impact is limited to availability (A:L, low severity). The absence of KEV status and no public exploit data suggests this is not actively exploited in the wild. Real-world risk is moderate: while any denial of service affecting a DNS infrastructure component is operationally significant, the high attack complexity substantially reduces the practical threat surface compared to easier DoS vectors. Organizations running dnsdist with PRSD detection enabled face localized service disruption risk but not widespread exploitation risk. The contradiction between network vector (AV:N) and high complexity (AC:H) suggests the attack requires either precise timing, specific DNS protocol states, or unusual network configurations.

An attacker sends a specially crafted DNS query with malformed PRSD detection data to a dnsdist instance. The PRSD parser processes the crafted packet, triggering an assertion failure in the detection engine. The assertion causes dnsdist to crash or enter an error state, disrupting DNS resolution for downstream clients until the service is manually restarted.