Skip to content
OpenAdvisories
High WID-SEC-2026-0932 7 CVEs

PowerDNS: Mehrere Schwachstellen

Published Mar 30, 2026 · Updated Jul 1, 2026 · Revision 6 · de-DE

Vendor: Debian Vendor: SUSE Product: Linux Product: Linux Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in PowerDNS ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, um einen Denial of Service zu verursachen und potentiell Code auszuführen.

Product

Der Domain Name Service (DNS) ermöglicht die Umsetzung der Domainnamen in IP-Adressen. Zur Verhinderung von übermäßigen Anfragen werden die Zuordnungen häufig lokal in einem Cache gespeichert.

Vulnerabilities 7

  • Medium 6.5
    CVE-2026-24029

    DNS over HTTPS ACL bypass

    When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2026-27853

    Out-of-bounds write when rewriting large DNS packets

    An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the in…

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-24028

    Out-of-bounds read when parsing DNS packets via Lua

    An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access un…

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-24030

    Unbounded memory allocation for DoQ and DoH3

    An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception a…

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Medium 4.8
    CVE-2026-27854

    Use after free when parsing EDNS options in Lua

    An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been…

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Low 3.1
    CVE-2026-0396

    HTML injection in the web dashboard

    An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:set…

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Low 3.1
    CVE-2026-0397

    Information disclosure via CORS misconfiguration

    When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root ca…

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine

Revision history

  1. #6

    Neue Updates von SUSE aufgenommen

  2. #5

    Neue Updates von Debian aufgenommen

  3. #4

    Neue Updates von SUSE aufgenommen

  4. #3

    Neue Updates von openSUSE aufgenommen

  5. #2

    Referenz(en) aufgenommen: EUVD-2026-17363, EUVD-2026-17403, EUVD-2026-17405, EUVD-2026-17409, EUVD-2026-17401, EUVD-2026-17361, EUVD-2026-17407

  6. #1

    Initiale Fassung

References