DNSdist at a glance
- Last 12 months
- 24
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 6 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 11 | 0 |
| Mar 2026 | 7 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 1 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 1 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
28 results · Feed
-
Low 3.7
EDNS options smuggling
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
-
Medium 5.3
Denial of service via crafted DoH3 queries
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent …
-
Medium 4.8
Out-of-bounds read in SetMacAddrAction
An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.
-
Medium 5.3
Denial of service via IXFR queries
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of conc…
-
Low 3.7
Denial of service via DoH3 queries
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
-
Low 3.7
Prometheus denial of service via crafted DNS queries
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until…
-
High 7.5
Denial of service via crafted DNSCrypt query
A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.
-
Medium 5.3
Outgoing DoH excessive memory allocation
A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.
-
Medium 5.3
DoQ/DoH3 excessive memory allocation
A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.
-
Low 3.7
PRSD detection denial of service
PRSD detection denial of service
-
Low 3.1
TCP backend stream ID overflow
A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend.
-
Medium 4.8
Out-of-bounds read in cache inspection via Lua
A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.
-
Low 3.1
Out-of-bounds read in service discovery
A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.
-
Medium 6.5
Off-by-one access when processing crafted UDP responses
A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.
-
Medium 5.3
Resource exhaustion via DoQ/DoH3 connections
An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.
-
Medium 5.3
Insufficient input validation of internal webserver
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
-
Medium 5.3
Insufficient input validation of internal webserver
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
-
Medium 4.8
Use after free when parsing EDNS options in Lua
An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been…
-
Medium 5.9
Out-of-bounds write when rewriting large DNS packets
An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the in…
-
Medium 5.3
Unbounded memory allocation for DoQ and DoH3
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception a…
-
Medium 6.5
DNS over HTTPS ACL bypass
When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.
-
Medium 5.3
Out-of-bounds read when parsing DNS packets via Lua
An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access un…
-
Low 3.1
Information disclosure via CORS misconfiguration
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root ca…
-
Low 3.1
HTML injection in the web dashboard
An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:set…
-
Low 3.7
Denial of service via crafted DoH exchange in PowerDNS DNSdist
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an une…
-
High 7.5
Denial of service via crafted TCP exchange
In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a c…
-
High 7.5
Denial of service via crafted DoH exchange
When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service. The remedy is: upg…
-
High 7.5
Transfer requests received over DoH can lead to a denial of service in DNSdist
When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS …