CVE-2026-27853
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
An attacker can trigger an out-of-bounds write in DNSdist by sending crafted DNS responses when using DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. The rewritten packet may exceed 65535 bytes, causing a crash and denial of service.
Risk Assessment
Risk of DNSdist server crash, potentially disrupting DNS services in the network.
Recommendation
Upgrade DNSdist to a version that includes a fix limiting the size of rewritten packets.
Other vulnerabilities in DNSdist
See all- CVE-2026-42004Low
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
- CVE-2017-7557High
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
- CVE-2026-27854Medium
An attacker can trigger a use-after-free in DNSdist by sending crafted DNS queries when using the DNSQuestion:getEDNSOptions method in custom Lua code. This can lead to a crash and denial of service.
- CVE-2026-24030Medium
An attacker can trick DNSdist into allocating excessive memory while processing DNS over QUIC or HTTP/3 payloads, causing a denial of service. In some cases the system may run out of memory and terminate the process.
- CVE-2026-0397Low
When the internal webserver is enabled (default is disabled), an attacker might trick an administrator into visiting a malicious website and extract configuration information. The root cause is a misconfigured CORS policy.
- CVE-2026-0396Low
An attacker can inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance with domain-based dynamic rules enabled.
Original NVD description (English source)
An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exceed 65535 bytes, potentially leading to a crash resulting in denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS