DNSdist EUVD-2026-24943

Patch DNSdist to the version specified in the Open-Xchange advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html. The fix addresses the query ID validation logic to prevent off-by-one errors leading to out-of-bounds writes. As a temporary compensating control pending patching, restrict network access to backend DNS servers to trusted, authenticated infrastructure only and implement network segmentation to prevent untrusted servers from reaching DNSdist. Additionally, monitor DNSdist process crashes and memory errors using operating system-level monitoring, as the out-of-bounds write typically results in detectable segmentation faults. Disable DNS forwarding to untrusted or public-facing backend servers until patched. Note that these controls may impact DNS service availability and should be implemented only if patching cannot be performed immediately.