dnsdist CVE-2026-33598

Exploitation requires all of the following: (1) dnsdist must have Lua scripting enabled (non-default configuration for some deployments); (2) custom Lua code must explicitly call getDomainListByAddress() or getAddressListByDomain() on packet cache objects; (3) a crafted DNS response must be cached and subsequently queried via the vulnerable Lua functions. Standard dnsdist deployments without custom Lua scripts are not affected. The high attack complexity (AC:H) reflects the need for an attacker to craft a specific malicious response, predict or control its caching, and ensure the vulnerable Lua code path is triggered.

CVSS 4.8 (AV:N/AC:H/PR:N/UI:N) indicates network-accessible exploitation with high complexity-meaning the attack requires specific preconditions or non-default configurations. The vector shows no authentication required and no user interaction needed, but AC:H (high complexity) significantly restricts practical exploitability. EPSS data not provided; without exploitation probability scoring, real-world risk assessment relies on attack vector and complexity signals. The impact is split: confidentiality low (information disclosure via out-of-bounds read) and availability low (potential DoS if memory corruption causes crash). No CISA KEV status provided, no public POC confirmed. The vulnerability is NOT a high-priority network-wide threat because exploitation requires (1) Lua scripting enabled and configured with the vulnerable functions, (2) a crafted packet cache entry, and (3) high attack complexity. Organizations using dnsdist with default configurations or without custom Lua code invoking these specific functions face minimal risk. However, deployments with active Lua packet manipulation policies warrant patching.

An attacker sends a malformed DNS response that is cached by dnsdist. If a custom Lua policy script running on the same instance calls getDomainListByAddress() or getAddressListByDomain() to inspect the cached entry, the Lua binding reads beyond buffer boundaries, leaking adjacent memory (information disclosure) or corrupting heap state (potential crash). The attack requires the attacker to control or predict which crafted response is cached-high complexity-and knowledge that the target runs vulnerable Lua code.