CVE-2026-24030
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An attacker can trick DNSdist into allocating excessive memory while processing DNS over QUIC or HTTP/3 payloads, causing a denial of service. In some cases the system may run out of memory and terminate the process.
Risk Assessment
Risk of DNSdist server disruption, potentially preventing domain name resolution in the network.
Recommendation
Upgrade DNSdist to a version that includes a fix limiting memory allocation for these protocols.
Other vulnerabilities in DNSdist
See all- CVE-2026-42004Low
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
- CVE-2017-7557High
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
- CVE-2026-27854Medium
An attacker can trigger a use-after-free in DNSdist by sending crafted DNS queries when using the DNSQuestion:getEDNSOptions method in custom Lua code. This can lead to a crash and denial of service.
- CVE-2026-27853Medium
An attacker can trigger an out-of-bounds write in DNSdist by sending crafted DNS responses when using DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. The rewritten packet may exceed 65535 bytes, causing a crash and denial of service.
- CVE-2026-0397Low
When the internal webserver is enabled (default is disabled), an attacker might trick an administrator into visiting a malicious website and extract configuration information. The root cause is a misconfigured CORS policy.
- CVE-2026-0396Low
An attacker can inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance with domain-based dynamic rules enabled.
Original NVD description (English source)
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS