Out-of-bounds read in dnsdist - CVE-2026-24028

Vulnerability identifier: #VU126956

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-24028

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in DNS packet parsing via newDNSPacketOverlay in custom Lua code when parsing crafted DNS response packets. A remote attacker can send a crafted DNS response packet to cause a denial of service.

The issue occurs when custom Lua code uses newDNSPacketOverlay to parse DNS packets, and the out-of-bounds read might also access unrelated memory.

dnsdist
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
Basesystem Module
dnsdist
dnsdist-debugsource
dnsdist-debuginfo
dnsdist (Debian package)

Install security update from vendor's website.

dnsdist - addressed in versions 1.9.12, 2.0.3
dnsdist - addressed in versions 1.9.12-1.el8, 1.9.12-1.el9, 1.9.12-1.fc42, 2.0.3-1.el10_3, 2.0.3-1.fc43, 2.0.3-1.fc44
dnsdist-debugsource - update to 1.9.12-150700.3.9.1
dnsdist-debuginfo - update to 1.9.12-150700.3.9.1
dnsdist - update to 1.9.12-150700.3.9.1
dnsdist (Debian package) - update to 1.9.14-0+deb13u1

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html
• https://docs.powerdns.com/dnsdist/security-advisories/powerdns-advisory-2026-02.html

• Fedora 43 update for dnsdist
• Fedora 42 update for dnsdist
• Fedora 44 update for dnsdist
• Fedora EPEL 10.3 update for dnsdist
• Fedora EPEL 9 update for dnsdist
• Fedora EPEL 8 update for dnsdist
• Multiple vulnerabilities in PowerDNS DNSdist
• SUSE update for dnsdist
• Debian update for dnsdist