CVE-2026-24028
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
An attacker can trigger an out-of-bounds read by sending a crafted DNS response packet when custom Lua code uses newDNSPacketOverlay to parse DNS packets. This may cause a crash (denial of service) or access unrelated memory (potential information disclosure).
Risk Assessment
The organization risks disruption of DNS services (DoS) or leakage of sensitive information from memory, potentially compromising confidentiality and availability.
Recommendation
It is recommended to update software using newDNSPacketOverlay to a patched version or avoid using this function with untrusted DNS data.
Original NVD description (English source)
An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access unrelated memory, leading to potential information disclosure.