Use-after-free in dnsdist - CVE-2026-27854

Vulnerability identifier: #VU126959

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-27854

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in EDNS option parsing via DNSQuestion:getEDNSOptions in custom Lua code when processing crafted DNS queries. A remote attacker can send crafted DNS queries to cause a denial of service.

The issue occurs in very specific setups where custom Lua code uses DNSQuestion:getEDNSOptions, and the vulnerable reference can point to a modified version of the DNS packet.

dnsdist
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
Basesystem Module
dnsdist
dnsdist-debugsource
dnsdist-debuginfo
dnsdist (Debian package)

Install security update from vendor's website.

dnsdist - addressed in versions 1.9.12, 2.0.3
dnsdist - addressed in versions 1.9.12-1.el8, 1.9.12-1.el9, 1.9.12-1.fc42, 2.0.3-1.el10_3, 2.0.3-1.fc43, 2.0.3-1.fc44
dnsdist-debugsource - update to 1.9.12-150700.3.9.1
dnsdist-debuginfo - update to 1.9.12-150700.3.9.1
dnsdist - update to 1.9.12-150700.3.9.1
dnsdist (Debian package) - update to 1.9.14-0+deb13u1

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html
• https://docs.powerdns.com/dnsdist/security-advisories/powerdns-advisory-2026-02.html

• Fedora 43 update for dnsdist
• Fedora 42 update for dnsdist
• Fedora 44 update for dnsdist
• Fedora EPEL 10.3 update for dnsdist
• Fedora EPEL 9 update for dnsdist
• Fedora EPEL 8 update for dnsdist
• Multiple vulnerabilities in PowerDNS DNSdist
• SUSE update for dnsdist
• Debian update for dnsdist