Executive brief
PowerDNS DNSdist, a load balancer for DNS traffic, is vulnerable to a flaw that could allow an attacker to crash the service or potentially access sensitive memory. This occurs when the system uses specific custom scripts to process DNS traffic. An exploit could lead to a service outage or the exposure of internal system information.
Technical details
A buffer over-read (CWE-126) exists in PowerDNS DNSdist when the 'newDNSPacketOverlay' Lua function is used to parse DNS packets. An attacker can trigger this vulnerability by sending a specially crafted DNS response packet. The root cause is located in the Lua DNS parser module (specifically dnsparser.hh). Successful exploitation can result in a process crash (Denial of Service) or the reading of unrelated memory (Information Disclosure). The vulnerability affects versions 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2; it is fixed in versions 1.9.12 and 2.0.3.
Affected products
- PowerDNS DNSdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2
Timeline
- 2026-02-11: disclosed: Discovery date
- 2026-03-31: advisory: Vendor advisory published
- 2026-03-31: patched: Fixed versions 1.9.12 and 2.0.3 released