EUVD-2026-17409

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a...

CVE-2026-27854 Use after free when parsing EDNS options in Lua

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a...

CVE-2026-27854

CVE-2026-27854 affects dnsdist. The vulnerability arises when crafted DNS queries invoke DNSQuestion:getEDNSOptions in custom Lua code, which can reference a modified DNS packet and trigger a use-after-free, potentially causing a crash and denial of service. Connected advisories across Debian/SUS...