CVE-2026-42004
LowCVSS 3.7Summary
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
Risk Assessment
The risk is that an attacker can bypass DNSdist filtering rules and pass unwanted EDNS options to the backend, potentially leading to unauthorized data processing or attacks on the DNS server.
Recommendation
It is recommended to immediately update DNSdist to the latest version that includes a fix for this vulnerability, and verify the configuration of EDNS filtering rules.
Other vulnerabilities in DNSdist
See all- CVE-2017-7557High
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
- CVE-2026-27854Medium
An attacker can trigger a use-after-free in DNSdist by sending crafted DNS queries when using the DNSQuestion:getEDNSOptions method in custom Lua code. This can lead to a crash and denial of service.
- CVE-2026-27853Medium
An attacker can trigger an out-of-bounds write in DNSdist by sending crafted DNS responses when using DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. The rewritten packet may exceed 65535 bytes, causing a crash and denial of service.
- CVE-2026-24030Medium
An attacker can trick DNSdist into allocating excessive memory while processing DNS over QUIC or HTTP/3 payloads, causing a denial of service. In some cases the system may run out of memory and terminate the process.
- CVE-2026-0397Low
When the internal webserver is enabled (default is disabled), an attacker might trick an administrator into visiting a malicious website and extract configuration information. The root cause is a misconfigured CORS policy.
- CVE-2026-0396Low
An attacker can inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance with domain-based dynamic rules enabled.
Original NVD description (English source)
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS