CVE-2018-14663

PowerDNS DNSDist prior to 1.3.3 is affected by a vulnerability where a crafted DNS query with trailing data could cause an EDNS Client Subnet/record addition to be smuggled to the backend, potentially exposing records unseen by dnsdist. This issue occurs when useClientSubnet or the experimental a...

CVE-2016-7069

CVE-2016-7069 affects dnsdist up to version 1.2.0, where parsing responses from a backend and removing an EDNS0 OPT record (when EDNS Client Subnet is enabled) could trigger undefined behavior on 32-bit systems, causing a crash. Technical details across connected sources confirm the vulnerability...

CVE-2017-7557

CVE-2017-7557 affects dnsdist 1.1.0, where an authentication flaw in the REST API potentially enables CSRF. Evidence across multiple advisories shows this vulnerability alongside other issues (CVE-2016-7069, CVE-2018-14663) and that fixes exist in later dnsdist releases. Upgrading to at least 1.2...

CVE-2026-33260

CVE-2026-33260 describes an input-validation flaw in the internal web server that can cause unlimited memory allocation when processing a web request, resulting in denial of service. The issue is documented across multiple feeds (NVD, ENISA EUVD, Debian OSV, CIRCL, etc.), all noting that the inte...

CVE-2026-24028

CVE-2026-24028 affects dnsdist, a DNS load balancer. The issue arises when custom Lua code parses DNS packets with newDNSPacketOverlay, causing an out-of-bounds read that can crash the process and potentially disclose memory. Connected advisories confirm the vulnerability and list it among multip...

CVE-2026-27853

CVE-2026-27853 affects dnsdist. The vulnerability arises when crafted DNS responses are processed by Lua code via DNSQuestion:changeName or DNSResponse:changeName, potentially causing an out-of-bounds write and denial of service. Connected advisories confirm dnsdist in multiple distros; Debian re...

CVE-2026-33599

CVE-2026-33599 describes a vulnerability in PowerDNS DNSdist where a rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request when triggered via the autoUpgrade (Lua) option to newServer or the auto_upgrade (YAML) setting. DDR upgrade is not enabled by default...

CVE-2026-33596

CVE-2026-33596 describes a vulnerability in PowerDNS DNSdist where a client could, in theory, cause a mismatch between queries sent to a backend and the responses by flooding with perfectly timed queries that are routed to a TCP-only or DNS over TLS backend. The issue is limited to the transport-...

CVE-2026-33257

The CVE-2026-33257 issue enables an attacker to send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. In the provided documents, no concrete product/vendor/version, root cause details ...

CVE-2026-24029

CVE-2026-24029 affects a DNS-over-HTTPS frontend using the nghttp2 provider. When the early_acl_drop (earlyACLDrop in Lua) option is disabled, the ACL check is skipped, permitting all clients to issue DoH queries regardless of the configured ACL. The default setting enables early_acl_drop, so the...

CVE-2026-0396

CVE-2026-0396 affects dnsdist, a DNS load balancer. The issue arises when domain-based dynamic rules are enabled (DynBlockRulesGroup:setSuffixMatchRule / setSuffixMatchRuleFFI), allowing crafted DNS queries to cause HTML content injection into the internal web dashboard. Associated advisories con...

CVE-2026-0397

CVE-2026-0397 in dnsdist is caused by a misconfigured CORS policy, enabling information disclosure when an admin user navigates to a malicious site via the dashboard. Connected advisories confirm multiple vendors (Debian, SUSE, Fedora, FreeBSD) have addressed this family of issues by releasing up...

CVE-2026-33595

The connected documents independently confirm CVE-2026-33595 affects PowerDNS DNSdist, describing a flaw where a client can trigger excessive memory allocation by generating many error responses over a single DoQ/DoH3 connection, with resources not released until connection end. This is the state...

CVE-2026-33254

CVE-2026-33254 affects PowerDNS DNSdist. An attacker can open a large number of concurrent DoQ/DoH3 connections, causing unbounded memory allocation and denial of service. DoQ/DoH3 are disabled by default, which mitigates impact per the sources; no patch/version details are provided in the docume...

CVE-2026-33597

CVE-2026-33597 affects PowerDNS DNSdist. A crafted DNS query containing an invalid label can prevent the PRSD detection algorithm ( DynBlockRulesGroup:setSuffixMatchRule or setSuffixMatchRuleFFI ) from being executed, potentially leading to a denial of service of PRSD detection. The reports consi...

CVE-2026-27854

CVE-2026-27854 affects dnsdist. The vulnerability arises when crafted DNS queries invoke DNSQuestion:getEDNSOptions in custom Lua code, which can reference a modified DNS packet and trigger a use-after-free, potentially causing a crash and denial of service. Connected advisories across Debian/SUS...

CVE-2026-24030

DNSdist (DNS load balancer) has a vulnerability CVE-2026-24030 where processing DNS over QUIC or DNS over HTTP/3 payloads may allocate unbounded memory, potentially causing denial of service and, in some cases, an out-of-memory state. Debian’s advisory notes a fix in dnsdist for stable (trixie) v...

CVE-2026-33594

CVE-2026-33594 describes a memory exhaustion issue where a client floods a DoH backend with queries, causing excess memory allocation as queries accumulate in a buffer that is only released at the end of the connection. The connected sources confirm the root cause (buffer growth tied to overloade...

CVE-2026-33598

PowerDNS DNSdist is affected by CVE-2026-33598: a cached crafted response can trigger an out-of-bounds read when Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache. Multiple vendors/advisories (SUSE, Red Hat, Debian, Alpine, EUVD, NVD) document the flaw. The pro...

CVE-2026-33593

The provided documents describe CVE-2026-33593 as a denial-of-service caused by a client sending a crafted DNSCrypt query that triggers a divide-by-zero error and crashes the affected process. The impact is a crash (availability impact HIGH per CVSS), but the connected sources do not specify the ...

CVE-2026-33602

CVE-2026-33602 concerns PowerDNS DNSdist (and related Linux distros) where a rogue backend can send a crafted UDP response with a query ID off by one relative to the maximum configured value. This leads to an out-of-bounds write and a denial of service. The connected documents confirm the same ro...