EUVD-2026-39351
GHSA-q4qq-c3qm-82jj
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no authentication; AC:H for required OPT craft precision; integrity limited to filter bypass reaching backend; no confidentiality or availability impact.
Primary rating from Vendor (open-xchange).
CVSS VectorVendor: open-xchange
Lifecycle Timeline
2DescriptionCVE.org
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
AnalysisAI
EDNS OPT filter bypass in DNSdist exposes backend DNS servers to EDNS extension options that DNSdist was configured to suppress. The flaw is triggered specifically by the EDNS Client Subnet (ECS) insertion code path, which silently normalizes a crafted malformed OPT record - one that evaded DNSdist's filter - into a syntactically valid OPT record forwarded to the upstream backend. No public exploit code exists and no active exploitation has been confirmed; CVSS rates this Low (3.7) reflecting both the high attack complexity and the limited integrity-only impact.
Technical ContextAI
DNSdist is a DNS load balancer and packet filter developed by PowerDNS (Open-Xchange), commonly deployed by ISPs and enterprises to front DNS resolvers or authoritative servers. EDNS (Extension Mechanisms for DNS, RFC 6891) uses a pseudo-RR type OPT to carry extension options in DNS messages. EDNS Client Subnet (ECS, RFC 7871) is one such option, embedding a portion of a client's IP address in resolver queries for geo-aware responses. When DNSdist is configured to insert ECS into outgoing queries, it must reconstruct or augment the OPT record in the packet. The root cause is a state inconsistency between two processing stages: the filter evaluation stage sees and discards the crafted OPT record, while the ECS insertion stage independently reconstructs a valid OPT record - inadvertently carrying over the previously-filtered EDNS options into the forwarded query. No CWE was formally assigned, but this maps to an improper neutralization or filter bypass class, where two code paths disagree on the authoritative representation of the same input.
RemediationAI
Consult the official PowerDNS security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html for the patched DNSdist release and upgrade instructions; the exact fixed version is not confirmed in the available CVE data and should not be assumed. As a compensating control pending upgrade, operators can disable EDNS Client Subnet insertion on any DNSdist rules where it is not operationally required - this eliminates the specific code path that triggers the filter bypass. The trade-off is degraded geo-aware DNS resolution for backends that rely on ECS for geographic load balancing. Restricting access to DNSdist's DNS listening interface to known resolver or client networks reduces the attacker surface but does not eliminate the vulnerability since the CVSS attack vector is network-accessible with no authentication requirement.
Same weakness CWE-115 – Misinterpretation of Input
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today