EUVD-2026-24935Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
6DescriptionCVE.org
A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend.
AnalysisAI
dnsdist can experience a denial-of-service condition through query-response mismatching when a client sends precisely timed floods of queries routed to TCP-only or DNS over TLS backends. An adjacent network attacker with high timing precision can cause limited availability impact by desynchronizing the query-response correlation on affected backends, though exploitation requires favorable network conditions and careful query timing. This issue carries a low CVSS score (3.1) reflecting the high attack complexity and adjacency requirement.
Technical ContextAI
dnsdist is a DNS load balancer and distribution tool that routes queries to backend DNS servers. The vulnerability involves the internal query-response matching mechanism used by dnsdist when forwarding queries over TCP or DNS over TLS (DoT) protocols. The root cause relates to how dnsdist correlates outbound queries with received responses when backend connections operate in these protocols, which maintain persistent connections but require explicit matching of queries to responses. An attacker positioned on the network adjacency can exploit timing-dependent race conditions to induce misalignment between sent queries and received answers, causing responses to be associated with incorrect original queries.
RemediationAI
Upgrade dnsdist to the patched version specified in the PowerDNS advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html. If immediate patching is not possible, operators can reduce risk by implementing network-level controls to restrict access to dnsdist from untrusted adjacent networks, limiting concurrent query rates, or disabling TCP-only and DNS over TLS backend routes if they are not essential to operations. Note that disabling these backend protocols may reduce redundancy or encryption protections, so this trade-off should be evaluated against the organization's DNS resilience requirements. Prioritize patching for dnsdist instances that handle traffic from less-trusted network segments.
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
PowerDNS dnsdist allows unauthenticated DNS over HTTPS (DoH) queries to bypass access control lists when the early_acl_d
DNSdist fails to validate packet size bounds when rewriting DNS questions or responses via Lua methods (DNSQuestion:chan
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing d
Memory exhaustion in DNSdist allows remote, unauthenticated attackers to trigger denial of service by crafting malicious
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
DNSdist instances using custom Lua code can be crashed via denial of service when the DNSQuestion:getEDNSOptions method
Denial of service in dnsdist via crafted PRSD (PowerDNS Response Detection) queries causes assertion failure and service
dnsdist's Discovery of Designated Resolvers (DDR) upgrade mechanism allows a rogue backend to send a crafted SVCB respon
HTML injection in DNSdist internal web dashboard allows remote unauthenticated attackers to inject malicious content via
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today