DNSdist CVE-2026-33602

A rogue or compromised backend DNS server must be configured as a valid backend in DNSdist, OR the attacker must have network access to intercept and modify responses from legitimate backend servers. The attack is limited to scenarios where the attacker can control or intercept backend server responses, making it unsuitable for direct remote attacks against uncompromised infrastructure. The query ID validation logic must use a bounded integer range with an off-by-one error, which is exploitable only when the malicious query ID matches exactly the off-by-one condition relative to the maximum configured value. Non-default configurations that use non-standard query ID ranges may be less exploitable, though the underlying logic flaw remains.

CVSS vector AV:N/AC:H indicates network-reachable but requires high complexity, suggesting the attacker must either compromise a legitimate backend or intercept backend responses. The integrity impact (I:L) and availability impact (A:H) are concerning, though confidentiality is not affected. EPSS data is not provided, preventing calculation of real-world exploitation probability. The vulnerability is not listed in CISA KEV at time of analysis, indicating no confirmed active exploitation. The absence of a public exploit code mention suggests limited weaponization, though the technical simplicity of crafting a malicious UDP response means a POC could be created rapidly. High complexity requirement (AC:H) is the primary limiting factor - attacker must either control a backend server or achieve network interception. Real-world risk is elevated for organizations with untrusted or compromised backend servers, but lower for properly segmented networks where backend servers are controlled infrastructure. The denial of service impact on a critical DNS load balancer could cascade to affecting all downstream services.

An attacker compromises or sets up a rogue DNS backend server and registers it with a DNSdist instance. When DNSdist forwards a DNS query to the attacker's backend, the attacker responds with a carefully crafted UDP packet containing a query ID value off-by-one from the configured maximum. DNSdist's query ID validation code fails to properly bounds-check this edge-case value, writing beyond the allocated buffer and corrupting adjacent memory, resulting in a crash that disrupts all DNS services relying on that DNSdist instance.