SUSE-SU-2026:1618-1 - Vulnerability-Lookup

SUSE-SU-2026:1618-1

Vulnerability from csaf_suse - Published: 2026-04-24 14:25 - Updated: 2026-04-24 14:25

Summary

Security update for dnsdist

Severity

Moderate

Notes

Title of the patch: Security update for dnsdist

Description of the patch: This update for dnsdist fixes the following issues: Update to version 1.9.12. - https://www.dnsdist.org/changelog.html#change-1.9.12 Security issues fixed: - CVE-2026-0396: crafted DNS queries triggering domain-based dynamic rules can lead to HTML injection in the web dashboard (bsc#1261236). - CVE-2026-0397: misconfiguration of the CORS policy can lead to information disclosure (bsc#1261237). - CVE-2026-24028: crafted DNS packet parsed by Lua code using `newDNSPacketOverlay` can lead to an out-of-bounds read (bsc#1261238). - CVE-2026-24029: disabled option on a DNS over HTTPS nghttp2 frontend allows clients to bypass ACLs and send DoH queries (bsc#1261239). - CVE-2026-24030: crafted DoQ and DoH3 queries can lead to unbounded memory allocation and DoS (bsc#1261240). - CVE-2026-27853: crafted DNS responses sent to a DNSdist using certain methods in custom Lua code (`changeName`) can lead to an out-of-bounds write (bsc#1261243). - CVE-2026-27854: crafted DNS queries sent to a DNSdist using the `DNSQuestion:getEDNSOptions` method in custom Lua code can lead to a use-after-free (bsc#1261241).

Patchnames: SUSE-2026-1618,SUSE-SLE-Module-Basesystem-15-SP7-2026-1618

Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

CVE-2026-0396

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-0397

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-24028

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-24029

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-24030

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-27853

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-27854

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

References

URL

Category

	https://www.suse.com/support/security/rating/	external
	https://ftp.suse.com/pub/projects/security/csaf/s…	self
	https://www.suse.com/support/update/announcement/…	self
	https://lists.suse.com/pipermail/sle-updates/2026…	self
	https://bugzilla.suse.com/1261236	self
	https://bugzilla.suse.com/1261237	self
	https://bugzilla.suse.com/1261238	self
	https://bugzilla.suse.com/1261239	self
	https://bugzilla.suse.com/1261240	self
	https://bugzilla.suse.com/1261241	self
	https://bugzilla.suse.com/1261243	self
	https://www.suse.com/security/cve/CVE-2026-0396/	self
	https://www.suse.com/security/cve/CVE-2026-0397/	self
	https://www.suse.com/security/cve/CVE-2026-24028/	self
	https://www.suse.com/security/cve/CVE-2026-24029/	self
	https://www.suse.com/security/cve/CVE-2026-24030/	self
	https://www.suse.com/security/cve/CVE-2026-27853/	self
	https://www.suse.com/security/cve/CVE-2026-27854/	self
	https://www.suse.com/security/cve/CVE-2026-0396	external
	https://bugzilla.suse.com/1261236	external
	https://www.suse.com/security/cve/CVE-2026-0397	external
	https://bugzilla.suse.com/1261237	external
	https://www.suse.com/security/cve/CVE-2026-24028	external
	https://bugzilla.suse.com/1261238	external
	https://www.suse.com/security/cve/CVE-2026-24029	external
	https://bugzilla.suse.com/1261239	external
	https://www.suse.com/security/cve/CVE-2026-24030	external
	https://bugzilla.suse.com/1261240	external
	https://www.suse.com/security/cve/CVE-2026-27853	external
	https://bugzilla.suse.com/1261241	external
	https://www.suse.com/security/cve/CVE-2026-27854	external
	https://bugzilla.suse.com/1261243	external

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for dnsdist",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for dnsdist fixes the following issues:\n\nUpdate to version 1.9.12.\n\n- https://www.dnsdist.org/changelog.html#change-1.9.12\n\nSecurity issues fixed:\n\n- CVE-2026-0396: crafted DNS queries triggering domain-based dynamic rules can lead to HTML injection in the web\n  dashboard (bsc#1261236).\n- CVE-2026-0397: misconfiguration of the CORS policy can lead to information disclosure (bsc#1261237).\n- CVE-2026-24028: crafted DNS packet parsed by Lua code using `newDNSPacketOverlay` can lead to an out-of-bounds read\n  (bsc#1261238).\n- CVE-2026-24029: disabled option on a DNS over HTTPS nghttp2 frontend allows clients to bypass ACLs and send DoH\n  queries (bsc#1261239).\n- CVE-2026-24030: crafted DoQ and DoH3 queries can lead to unbounded memory allocation and DoS (bsc#1261240).\n- CVE-2026-27853: crafted DNS responses sent to a DNSdist using certain methods in custom Lua code (`changeName`) can\n  lead to an out-of-bounds write (bsc#1261243).  \n- CVE-2026-27854: crafted DNS queries sent to a DNSdist using the `DNSQuestion:getEDNSOptions` method in custom Lua\n  code can lead to a use-after-free (bsc#1261241).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-1618,SUSE-SLE-Module-Basesystem-15-SP7-2026-1618",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1618-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:1618-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261618-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:1618-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045968.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261236",
        "url": "https://bugzilla.suse.com/1261236"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261237",
        "url": "https://bugzilla.suse.com/1261237"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261238",
        "url": "https://bugzilla.suse.com/1261238"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261239",
        "url": "https://bugzilla.suse.com/1261239"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261240",
        "url": "https://bugzilla.suse.com/1261240"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261241",
        "url": "https://bugzilla.suse.com/1261241"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261243",
        "url": "https://bugzilla.suse.com/1261243"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0396 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0396/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0397 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0397/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24028 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24028/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24029 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24029/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24030 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24030/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27853 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27853/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27854 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27854/"
      }
    ],
    "title": "Security update for dnsdist",
    "tracking": {
      "current_release_date": "2026-04-24T14:25:54Z",
      "generator": {
        "date": "2026-04-24T14:25:54Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:1618-1",
      "initial_release_date": "2026-04-24T14:25:54Z",
      "revision_history": [
        {
          "date": "2026-04-24T14:25:54Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsdist-1.9.12-150700.3.9.1.aarch64",
                "product": {
                  "name": "dnsdist-1.9.12-150700.3.9.1.aarch64",
                  "product_id": "dnsdist-1.9.12-150700.3.9.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsdist-1.9.12-150700.3.9.1.i586",
                "product": {
                  "name": "dnsdist-1.9.12-150700.3.9.1.i586",
                  "product_id": "dnsdist-1.9.12-150700.3.9.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsdist-1.9.12-150700.3.9.1.ppc64le",
                "product": {
                  "name": "dnsdist-1.9.12-150700.3.9.1.ppc64le",
                  "product_id": "dnsdist-1.9.12-150700.3.9.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsdist-1.9.12-150700.3.9.1.s390x",
                "product": {
                  "name": "dnsdist-1.9.12-150700.3.9.1.s390x",
                  "product_id": "dnsdist-1.9.12-150700.3.9.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsdist-1.9.12-150700.3.9.1.x86_64",
                "product": {
                  "name": "dnsdist-1.9.12-150700.3.9.1.x86_64",
                  "product_id": "dnsdist-1.9.12-150700.3.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsdist-1.9.12-150700.3.9.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64"
        },
        "product_reference": "dnsdist-1.9.12-150700.3.9.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsdist-1.9.12-150700.3.9.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le"
        },
        "product_reference": "dnsdist-1.9.12-150700.3.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsdist-1.9.12-150700.3.9.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x"
        },
        "product_reference": "dnsdist-1.9.12-150700.3.9.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsdist-1.9.12-150700.3.9.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
        },
        "product_reference": "dnsdist-1.9.12-150700.3.9.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-0396",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0396"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0396",
          "url": "https://www.suse.com/security/cve/CVE-2026-0396"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261236 for CVE-2026-0396",
          "url": "https://bugzilla.suse.com/1261236"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-24T14:25:54Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-0396"
    },
    {
      "cve": "CVE-2026-0397",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0397"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0397",
          "url": "https://www.suse.com/security/cve/CVE-2026-0397"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261237 for CVE-2026-0397",
          "url": "https://bugzilla.suse.com/1261237"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-24T14:25:54Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-0397"
    },
    {
      "cve": "CVE-2026-24028",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24028"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access unrelated memory, leading to potential information disclosure.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24028",
          "url": "https://www.suse.com/security/cve/CVE-2026-24028"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261238 for CVE-2026-24028",
          "url": "https://bugzilla.suse.com/1261238"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-24T14:25:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24028"
    },
    {
      "cve": "CVE-2026-24029",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24029"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24029",
          "url": "https://www.suse.com/security/cve/CVE-2026-24029"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261239 for CVE-2026-24029",
          "url": "https://bugzilla.suse.com/1261239"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-24T14:25:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24029"
    },
    {
      "cve": "CVE-2026-24030",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24030"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24030",
          "url": "https://www.suse.com/security/cve/CVE-2026-24030"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261240 for CVE-2026-24030",
          "url": "https://bugzilla.suse.com/1261240"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-24T14:25:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24030"
    },
    {
      "cve": "CVE-2026-27853",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27853"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exceed 65535 bytes, potentially leading to a crash resulting in denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27853",
          "url": "https://www.suse.com/security/cve/CVE-2026-27853"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261241 for CVE-2026-27853",
          "url": "https://bugzilla.suse.com/1261241"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-24T14:25:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-27853"
    },
    {
      "cve": "CVE-2026-27854",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27854"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27854",
          "url": "https://www.suse.com/security/cve/CVE-2026-27854"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261243 for CVE-2026-27854",
          "url": "https://bugzilla.suse.com/1261243"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:dnsdist-1.9.12-150700.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-24T14:25:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-27854"
    }
  ]
}

CVE-2026-0396 (GCVE-0-2026-0396)

Vulnerability from cvelistv5 – Published: 2026-03-31 11:50 – Updated: 2026-03-31 13:21

Title

HTML injection in the web dashboard

Summary

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Severity ?

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

OX

References

URL

Tags

https://www.dnsdist.org/security-advisories/power…

Impacted products

	Vendor	Product	Version
	PowerDNS	DNSdist	Affected: 1.9.0 , < 1.9.12 (semver) Affected: 2.0.0 , < 2.0.3 (semver)

Date Public ?

2026-03-30 22:00

Credits

Aisle Research

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0396",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T13:21:05.454104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-80",
                "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:21:08.549Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.powerdns.com/",
          "defaultStatus": "unaffected",
          "modules": [
            "Web Dashboard"
          ],
          "packageName": "dnsdist",
          "product": "DNSdist",
          "programFiles": [
            "html/local.js"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "vendor": "PowerDNS",
          "versions": [
            {
              "lessThan": "1.9.12",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aisle Research"
        }
      ],
      "datePublic": "2026-03-30T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.\u003c/p\u003e"
            }
          ],
          "value": "An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T11:50:51.442Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTML injection in the web dashboard",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2026-0396",
    "datePublished": "2026-03-31T11:50:51.442Z",
    "dateReserved": "2025-11-28T09:18:05.355Z",
    "dateUpdated": "2026-03-31T13:21:08.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27853 (GCVE-0-2026-27853)

Vulnerability from cvelistv5 – Published: 2026-03-31 12:04 – Updated: 2026-03-31 13:17

Title

Out-of-bounds write when rewriting large DNS packets

Summary

An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exceed 65535 bytes, potentially leading to a crash resulting in denial of service.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

Out-of-bounds Write

Assigner

OX

References

URL

Tags

https://www.dnsdist.org/security-advisories/power…

Impacted products

	Vendor	Product	Version
	PowerDNS	DNSdist	Affected: 1.9.0 , < 1.9.12 (semver) Affected: 2.0.0 , < 2.0.3 (semver)

Date Public ?

2026-03-30 22:00

Credits

ilya rozentsvaig

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27853",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T13:14:03.664956Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:17:25.025Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.powerdns.com/",
          "defaultStatus": "unaffected",
          "modules": [
            "DNS packet writer"
          ],
          "packageName": "dnsdist",
          "product": "DNSdist",
          "programFiles": [
            "dnswriter.cc"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "vendor": "PowerDNS",
          "versions": [
            {
              "lessThan": "1.9.12",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ilya rozentsvaig"
        }
      ],
      "datePublic": "2026-03-30T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exceed 65535 bytes, potentially leading to a crash resulting in denial of service.\u003c/p\u003e"
            }
          ],
          "value": "An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exceed 65535 bytes, potentially leading to a crash resulting in denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T12:04:23.419Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds write when rewriting large DNS packets",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2026-27853",
    "datePublished": "2026-03-31T12:04:23.419Z",
    "dateReserved": "2026-02-24T08:46:09.373Z",
    "dateUpdated": "2026-03-31T13:17:25.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27854 (GCVE-0-2026-27854)

Vulnerability from cvelistv5 – Published: 2026-03-31 12:06 – Updated: 2026-04-02 13:46

Title

Use after free when parsing EDNS options in Lua

Summary

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Severity ?

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE

Use After Free

Assigner

OX

References

URL

Tags

https://www.dnsdist.org/security-advisories/power…

Impacted products

	Vendor	Product	Version
	PowerDNS	DNSdist	Affected: 1.9.0 , < 1.9.12 (semver) Affected: 2.0.0 , < 2.0.3 (semver)

Date Public ?

2026-03-30 22:00

Credits

Naoki Wakamatsu

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27854",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T13:12:37.483504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:12:40.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.powerdns.com/",
          "defaultStatus": "unaffected",
          "modules": [
            "EDNS options cache"
          ],
          "packageName": "dnsdist",
          "product": "DNSdist",
          "programFiles": [
            "dnsdist.hh"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "vendor": "PowerDNS",
          "versions": [
            {
              "lessThan": "1.9.12",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoki Wakamatsu"
        }
      ],
      "datePublic": "2026-03-30T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.\u003c/p\u003e"
            }
          ],
          "value": "An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T13:46:22.087Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use after free when parsing EDNS options in Lua",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2026-27854",
    "datePublished": "2026-03-31T12:06:46.648Z",
    "dateReserved": "2026-02-24T08:46:09.373Z",
    "dateUpdated": "2026-04-02T13:46:22.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24028 (GCVE-0-2026-24028)

Vulnerability from cvelistv5 – Published: 2026-03-31 11:57 – Updated: 2026-03-31 13:18

Title

Out-of-bounds read when parsing DNS packets via Lua

Summary

An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access unrelated memory, leading to potential information disclosure.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

Buffer Over-read

Assigner

OX

References

URL

Tags

https://www.dnsdist.org/security-advisories/power…

Impacted products

	Vendor	Product	Version
	PowerDNS	DNSdist	Affected: 1.9.0 , < 1.9.12 (semver) Affected: 2.0.0 , < 2.0.3 (semver)

Date Public ?

2026-03-30 22:00

Credits

Naoki Wakamatsu

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24028",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T13:18:03.818786Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-126",
                "description": "CWE-126 Buffer Over-read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:18:41.769Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.powerdns.com/",
          "defaultStatus": "unaffected",
          "modules": [
            "Lua DNS parser"
          ],
          "packageName": "dnsdist",
          "product": "DNSdist",
          "programFiles": [
            "dnsparser.hh"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "vendor": "PowerDNS",
          "versions": [
            {
              "lessThan": "1.9.12",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoki Wakamatsu"
        }
      ],
      "datePublic": "2026-03-30T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access unrelated memory, leading to potential information disclosure.\u003c/p\u003e"
            }
          ],
          "value": "An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access unrelated memory, leading to potential information disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Buffer Over-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T11:57:26.914Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds read when parsing DNS packets via Lua",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2026-24028",
    "datePublished": "2026-03-31T11:57:26.914Z",
    "dateReserved": "2026-01-20T14:56:25.872Z",
    "dateUpdated": "2026-03-31T13:18:41.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24030 (GCVE-0-2026-24030)

Vulnerability from cvelistv5 – Published: 2026-03-31 12:01 – Updated: 2026-03-31 13:14

Title

Unbounded memory allocation for DoQ and DoH3

Summary

An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

Uncontrolled Memory Allocation

Assigner

OX

References

URL

Tags

https://www.dnsdist.org/security-advisories/power…

Impacted products

	Vendor	Product	Version
	PowerDNS	DNSdist	Affected: 1.9.0 , < 1.9.12 (semver) Affected: 2.0.0 , < 2.0.3 (semver)

Date Public ?

2026-03-30 22:00

Credits

XavLimSG

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24030",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T13:14:53.937284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-789",
                "description": "CWE-789 Memory Allocation with Excessive Size Value",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:14:57.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.powerdns.com/",
          "defaultStatus": "unaffected",
          "modules": [
            "Incoming DNS over QUIC",
            "Incoming DNS over HTTP/3"
          ],
          "packageName": "dnsdist",
          "product": "DNSdist",
          "programFiles": [
            "doq.cc",
            "doh3.cc"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "vendor": "PowerDNS",
          "versions": [
            {
              "lessThan": "1.9.12",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "XavLimSG"
        }
      ],
      "datePublic": "2026-03-30T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.\u003c/p\u003e"
            }
          ],
          "value": "An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Uncontrolled Memory Allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T12:01:00.883Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unbounded memory allocation for DoQ and DoH3",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2026-24030",
    "datePublished": "2026-03-31T12:01:00.883Z",
    "dateReserved": "2026-01-20T14:56:25.872Z",
    "dateUpdated": "2026-03-31T13:14:57.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0397 (GCVE-0-2026-0397)

Vulnerability from cvelistv5 – Published: 2026-03-31 11:53 – Updated: 2026-03-31 13:20

Title

Information disclosure via CORS misconfiguration

Summary

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Severity ?

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE

Overly Permissive Cross-domain Whitelist

Assigner

OX

References

URL

Tags

https://www.dnsdist.org/security-advisories/power…

Impacted products

	Vendor	Product	Version
	PowerDNS	DNSdist	Affected: 1.9.0 , < 1.9.12 (semver) Affected: 2.0.0 , < 2.0.3 (semver)

Date Public ?

2026-03-30 22:00

Credits

Surya Narayan Kushwaha (aka Cavid)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T13:19:54.934769Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-942",
                "description": "CWE-942 Permissive Cross-domain Policy with Untrusted Domains",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:20:22.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.powerdns.com/",
          "defaultStatus": "unaffected",
          "modules": [
            "Internal Web Server"
          ],
          "packageName": "dnsdist",
          "product": "DNSdist",
          "programFiles": [
            "dnsdist-web.cc"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "vendor": "PowerDNS",
          "versions": [
            {
              "lessThan": "1.9.12",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Surya Narayan Kushwaha (aka Cavid)"
        }
      ],
      "datePublic": "2026-03-30T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhen the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.\u003c/p\u003e"
            }
          ],
          "value": "When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Overly Permissive Cross-domain Whitelist",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T11:53:13.444Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Information disclosure via CORS misconfiguration",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2026-0397",
    "datePublished": "2026-03-31T11:53:13.444Z",
    "dateReserved": "2025-11-28T09:18:06.484Z",
    "dateUpdated": "2026-03-31T13:20:22.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24029 (GCVE-0-2026-24029)

Vulnerability from cvelistv5 – Published: 2026-03-31 11:59 – Updated: 2026-03-31 13:15

Title

DNS over HTTPS ACL bypass

Summary

When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

Incorrect Authorization

Assigner

OX

References

URL

Tags

https://www.dnsdist.org/security-advisories/power…

Impacted products

	Vendor	Product	Version
	PowerDNS	DNSdist	Affected: 1.9.0 , < 1.9.12 (semver) Affected: 2.0.0 , < 2.0.3 (semver)

Date Public ?

2026-03-30 22:00

Credits

Surya Narayan Kushwaha (aka Cavid)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24029",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T13:15:34.638851Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:15:37.448Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.powerdns.com/",
          "defaultStatus": "unaffected",
          "modules": [
            "Incoming DNS over HTTPS"
          ],
          "packageName": "dnsdist",
          "product": "DNSdist",
          "programFiles": [
            "dnsdist-nghttp2-in.cc"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "vendor": "PowerDNS",
          "versions": [
            {
              "lessThan": "1.9.12",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Surya Narayan Kushwaha (aka Cavid)"
        }
      ],
      "datePublic": "2026-03-30T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhen the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.\u003c/p\u003e"
            }
          ],
          "value": "When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T11:59:12.903Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DNS over HTTPS ACL bypass",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2026-24029",
    "datePublished": "2026-03-31T11:59:12.903Z",
    "dateReserved": "2026-01-20T14:56:25.872Z",
    "dateUpdated": "2026-03-31T13:15:37.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.