Skip to main content

dnsdist EUVDEUVD-2026-24939

| CVE-2026-33598 MEDIUM
Out-of-bounds Read (CWE-125)
2026-04-22 security@open-xchange.com GHSA-vx33-3w38-3rj6
Buffer Overflow Information Disclosure Suse
4.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

6
Patch released
Apr 24, 2026 - 18:51 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
Analysis Generated
Apr 22, 2026 - 15:02 vuln.today
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24939
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
MEDIUM 4.8

DescriptionCVE.org

A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.

AnalysisAI

Out-of-bounds memory read in dnsdist allows remote attackers to trigger information disclosure or denial of service when custom Lua code invokes getDomainListByAddress() or getAddressListByDomain() functions on a crafted packet cache entry. The vulnerability requires network access but has high attack complexity, limiting real-world exploitation despite the remote attack vector.

Technical ContextAI

dnsdist is a DNS load balancer and distributor written in C++ that supports custom Lua scripting for policy and packet manipulation. The vulnerability exists in the Lua bindings for packet cache query functions-specifically getDomainListByAddress() and getAddressListByDomain()-which do not properly validate response boundaries before reading cached DNS response data. When a maliciously crafted DNS response is cached and subsequently queried via these Lua functions, the parser reads beyond allocated buffer boundaries. This is a classic buffer bounds violation in C++ code interfacing with a scripting language that lacks automatic bounds checking.

RemediationAI

Apply the patch released in PowerDNS advisory powerdns-advisory-for-dnsdist-2026-04 (https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html). Exact patched version number not specified in provided data; consult the advisory for the minimum upgrade version. As an interim compensating control, disable or restrict Lua scripting features if not essential to operations, or audit custom Lua policies to remove calls to getDomainListByAddress() and getAddressListByDomain() until patching is complete. Note that disabling Lua may impact DNS load balancing or custom routing policies depending on deployment design.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2016-1646 HIGH POC
8.8
CVE-2025-5777 HIGH POC
7.5
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

EUVD-2026-24939 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy