Out-of-bounds write in dnsdist - CVE-2026-27853

Vulnerability identifier: #VU126960

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-27853

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in packet rewriting via DNSQuestion:changeName or DNSResponse:changeName in custom Lua code when processing crafted DNS responses. A remote attacker can send crafted DNS responses to cause a denial of service.

The issue occurs in very specific setups using these custom Lua methods, where a rewritten packet can become larger than the initial response and exceed 65535 bytes.

dnsdist
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
Basesystem Module
dnsdist
dnsdist-debugsource
dnsdist-debuginfo
dnsdist (Debian package)

Install security update from vendor's website.

dnsdist - addressed in versions 1.9.12, 2.0.3
dnsdist - addressed in versions 1.9.12-1.el8, 1.9.12-1.el9, 1.9.12-1.fc42, 2.0.3-1.el10_3, 2.0.3-1.fc43, 2.0.3-1.fc44
dnsdist-debugsource - update to 1.9.12-150700.3.9.1
dnsdist-debuginfo - update to 1.9.12-150700.3.9.1
dnsdist - update to 1.9.12-150700.3.9.1
dnsdist (Debian package) - update to 1.9.14-0+deb13u1

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html
• https://docs.powerdns.com/dnsdist/security-advisories/powerdns-advisory-2026-02.html

• Fedora 43 update for dnsdist
• Fedora 42 update for dnsdist
• Fedora 44 update for dnsdist
• Fedora EPEL 10.3 update for dnsdist
• Fedora EPEL 9 update for dnsdist
• Fedora EPEL 8 update for dnsdist
• Multiple vulnerabilities in PowerDNS DNSdist
• SUSE update for dnsdist
• Debian update for dnsdist