Quick answers
- Is CVE-2026-27854 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-27854 being exploited in the wild.
- How severe is CVE-2026-27854?
- Medium severity, with a CVSS score of 4.8, published 31 March 2026.
- Which products and versions are affected?
- Powerdns Dnsdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2.
- Is there a fix for CVE-2026-27854?
- A patch was published on 2026-03-31: First fixed versions released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-27854 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-27854?
- Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free (CWE-416) vulnerability exists in PowerDNS DNSdist when the DNSQuestion:getEDNSOptions method is used in custom Lua scripts. The flaw occurs because the method may refer to a version of a DNS packet that has already been modified or freed in memory. An unauthenticated remote attacker can exploit this by sending specially crafted DNS queries, though the attack requires a specific configuration (high complexity). Successful exploitation can lead to a process crash (Denial of Service) or potential information disclosure. The issue is fixed in versions 1.9.12 and 2.0.3.
Affected products
- PowerDNS DNSdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2
Timeline
- 2026-02-22: disclosed: Discovery date
- 2026-03-31: advisory: NVD and Vendor advisory published
- 2026-03-31: patched: First fixed versions released