CVE-2026-27854
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
An attacker can trigger a use-after-free in DNSdist by sending crafted DNS queries when using the DNSQuestion:getEDNSOptions method in custom Lua code. This can lead to a crash and denial of service.
Risk Assessment
Risk of DNSdist server crash, potentially disrupting DNS services in the network.
Recommendation
Upgrade DNSdist to a version that includes a fix for the getEDNSOptions method.
Original NVD description (English source)
An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.