CVE-2026-0396

LowCVSS 3.1

Published: 31/03/2026(UTC)Updated: 25/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

An attacker can inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance with domain-based dynamic rules enabled.

Risk Assessment

Risk of injecting malicious HTML into the admin dashboard, potentially leading to session theft or further attacks.

Recommendation

Disable domain-based dynamic rules if not needed. Otherwise, restrict dashboard access and apply input filtering.

Original NVD description (English source)

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.