EUVD-2026-24937
GHSA-7mxf-3gj9-r25x
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
PRSD detection denial of service
AnalysisAI
Denial of service in dnsdist via crafted PRSD (PowerDNS Response Detection) queries causes assertion failure and service disruption on remote DNS resolvers. The vulnerability requires specific network conditions and crafted packet construction (AC:H) but affects default configurations without authentication. CVSS 3.7 reflects low availability impact with non-trivial exploitation complexity.
Technical ContextAI
dnsdist is a DNS load balancer and traffic distributor from PowerDNS. PRSD (PowerDNS Response Detection) is a DNS protocol extension used for advanced traffic analysis and filtering. The vulnerability exists in dnsdist's PRSD packet handling logic, where malformed or specially crafted PRSD queries trigger an assertion failure in the detection engine rather than graceful error handling. This likely involves improper bounds checking or type validation in the PRSD parser when processing the detection data structure.
RemediationAI
Consult the official PowerDNS dnsdist security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html for the specific patched version number and upgrade instructions. Pending patch availability, operators can mitigate by disabling PRSD detection if not required for operations (via dnsdist configuration), implementing rate limiting on DNS queries to reduce the window for crafted packet delivery, or restricting PRSD-based traffic to trusted upstream resolvers. Note that disabling PRSD detection may impact traffic analysis and load balancing features that depend on response detection.
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
Remote denial of service in dnsdist allows unauthenticated attackers to crash the DNS load balancer by sending specially
DNSdist fails to validate packet size bounds when rewriting DNS questions or responses via Lua methods (DNSQuestion:chan
Memory exhaustion in DNSdist allows remote, unauthenticated attackers to trigger denial of service by crafting malicious
DNSdist instances using custom Lua code can be crashed via denial of service when the DNSQuestion:getEDNSOptions method
DNSdist is vulnerable to denial of service via out-of-bounds write when processing crafted UDP responses from a rogue ba
PowerDNS dnsdist allows unauthenticated DNS over HTTPS (DoH) queries to bypass access control lists when the early_acl_d
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing d
Denial of service in PowerDNS Authoritative, Recursor, and dnsdist via unbounded memory allocation in their internal web
Unlimited memory allocation in PowerDNS internal web server allows remote denial of service via crafted web requests. Th
dnsdist allows remote denial-of-service attacks through memory exhaustion by generating numerous error responses on sing
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today