DNSdist EUVD-2026-39351

Exploitation requires that the target DNSdist instance has EDNS Client Subnet insertion explicitly enabled - this is the specific feature that triggers the filter bypass during OPT record reconstruction. Deployments where ECS insertion is disabled are not affected by this code path. Additionally, the operator must have configured EDNS option filtering rules that are intended to block specific OPT options, since the vulnerability is meaningful only when DNSdist is expected to filter options that it then inadvertently forwards. Attack complexity is rated High (AC:H), meaning the attacker must craft a precise OPT record structure that satisfies the inconsistency between DNSdist's two processing stages. No authentication is required (PR:N) and the attack is network-accessible, so any host that can send DNS queries to DNSdist's listener port can attempt exploitation. The attack is limited to filter policy evasion - the attacker cannot execute code, crash DNSdist, or read arbitrary data from the system.

The CVSS 3.1 score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the threat profile. The attack is network-accessible with no authentication required, but AC:H reflects the precision needed to craft an OPT record that threads the specific inconsistency between DNSdist's filter and its ECS insertion logic. The integrity impact is Low (I:L): the backend DNS server processes EDNS options the operator intended to suppress, which can undermine privacy policies (e.g., preventing ECS client-subnet data from reaching certain backends) or security filtering rules, but does not represent code execution or data exfiltration. The 'Information Disclosure' tag is consistent with a scenario where suppressed ECS data - containing partial client IP addresses - propagates to backends unintentionally. No EPSS score was provided, no active exploitation is observed, and this vulnerability is absent from the CISA KEV catalog. Overall, this is a policy-bypass vulnerability with limited blast radius: realistic harm requires that an operator has deliberately configured ECS insertion and EDNS option filtering in the same rule set, which narrows the affected deployment population further.

An attacker sends a crafted DNS query to a DNSdist instance containing a specially structured EDNS OPT record - malformed or edge-case enough to be silently dropped by DNSdist's configured filter rules, yet structured such that the ECS insertion code path reconstructs it into a valid OPT record carrying the originally-filtered EDNS options. The upstream backend DNS server receives the reconstructed query and processes the suppressed options, potentially logging or acting on client subnet data the operator intended to withhold. No public proof-of-concept code has been identified at time of analysis.