CVE-2026-0396
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
An attacker can inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance with domain-based dynamic rules enabled.
Risk Assessment
Risk of injecting malicious HTML into the admin dashboard, potentially leading to session theft or further attacks.
Recommendation
Disable domain-based dynamic rules if not needed. Otherwise, restrict dashboard access and apply input filtering.
Other vulnerabilities in DNSdist
See all- CVE-2026-42004Low
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
- CVE-2017-7557High
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
- CVE-2026-27854Medium
An attacker can trigger a use-after-free in DNSdist by sending crafted DNS queries when using the DNSQuestion:getEDNSOptions method in custom Lua code. This can lead to a crash and denial of service.
- CVE-2026-27853Medium
An attacker can trigger an out-of-bounds write in DNSdist by sending crafted DNS responses when using DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. The rewritten packet may exceed 65535 bytes, causing a crash and denial of service.
- CVE-2026-24030Medium
An attacker can trick DNSdist into allocating excessive memory while processing DNS over QUIC or HTTP/3 payloads, causing a denial of service. In some cases the system may run out of memory and terminate the process.
- CVE-2026-0397Low
When the internal webserver is enabled (default is disabled), an attacker might trick an administrator into visiting a malicious website and extract configuration information. The root cause is a misconfigured CORS policy.
Original NVD description (English source)
An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS