Executive brief
PowerDNS DNSdist, a load balancer for DNS traffic, is vulnerable to a flaw that could allow an attacker to crash the service. By sending specially crafted DNS queries to a system using specific custom scripts, an attacker can trigger a memory error. This results in a denial of service, potentially disrupting internet name resolution for users and applications.
Technical details
A use-after-free (CWE-416) vulnerability exists in PowerDNS DNSdist when the DNSQuestion:getEDNSOptions method is used in custom Lua scripts. The flaw occurs because the method may refer to a version of a DNS packet that has already been modified or freed in memory. An unauthenticated remote attacker can exploit this by sending specially crafted DNS queries, though the attack requires a specific configuration (high complexity). Successful exploitation can lead to a process crash (Denial of Service) or potential information disclosure. The issue is fixed in versions 1.9.12 and 2.0.3.
Affected products
- PowerDNS DNSdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2
Timeline
- 2026-02-22: disclosed: Discovery date
- 2026-03-31: advisory: NVD and Vendor advisory published
- 2026-03-31: patched: First fixed versions released