Skip to content
OpenAdvisories
Medium WID-SEC-2026-1230 11 CVEs

DNSdist: Mehrere Schwachstellen ermöglichen Denial of Service

Published Apr 21, 2026 · Updated Aug 5, 2026 · Revision 7 · de-DE

Vendor: cPanel Vendor: Debian Vendor: Fedora Vendor: SUSE Product: cPanel/WHM Product: Linux Product: Linux Product: Linux Product: openSUSE

Summary

Ein Angreifer kann mehrere Schwachstellen in DNSdist ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

DNSdist ist ein DNS-Traffic-Manager, der als Load-Balancer, Filter und Sicherheits-Gateway vor DNS-Servern eingesetzt wird

Vulnerabilities 11

  • High 7.5
    CVE-2026-33593

    Denial of service via crafted DNSCrypt query

    A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-33602

    Off-by-one access when processing crafted UDP responses

    A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-33254

    Resource exhaustion via DoQ/DoH3 connections

    An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-33257

    Insufficient input validation of internal webserver

    An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

    PowerDNS Recursor DNSdist Authoritative Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-33260

    Insufficient input validation of internal webserver

    An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

    PowerDNS Recursor DNSdist Authoritative Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-33594

    Outgoing DoH excessive memory allocation

    A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-33595

    DoQ/DoH3 excessive memory allocation

    A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Medium 4.8
    CVE-2026-33598

    Out-of-bounds read in cache inspection via Lua

    A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Low 3.7
    CVE-2026-33597

    PRSD detection denial of service

    PRSD detection denial of service

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Low 3.1
    CVE-2026-33596

    TCP backend stream ID overflow

    A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend.

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine
  • Low 3.1
    CVE-2026-33599

    Out-of-bounds read in service discovery

    A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.

    PowerDNS DNSdist dnsdist dnsdist Debian Ubuntu Alpine

Revision history

  1. #7

    Neue Updates aufgenommen

  2. #6

    Neue Updates von SUSE aufgenommen

  3. #5

    Neue Updates von Fedora aufgenommen

  4. #4

    Neue Updates von openSUSE aufgenommen

  5. #3

    Neue Updates von Debian aufgenommen

  6. #2

    Referenz(en) aufgenommen: EUVD-2026-24720, EUVD-2026-24725, EUVD-2026-24937, EUVD-2026-24931, EUVD-2026-24929, EUVD-2026-24939, EUVD-2026-24935, EUVD-2026-24927, EUVD-2026-24933, EUVD-2026-24941, EUVD-2026-24943

  7. #1

    Initiale Fassung

References