# CVE-2026-27854: PowerDNS DNSdist use-after-free in DNSQuestion:getEDNSOptions

Source: https://junglewise.ai/threats/cve-2026-27854-powerdns-dnsdist-use-after-free-in-dnsquestion-getednsoptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-27854 · Severity: medium · CVSS 4.8 · Published 2026-03-31

PowerDNS DNSdist, a load balancer for DNS traffic, is vulnerable to a flaw that could allow an attacker to crash the service. By sending specially crafted DNS queries to a system using specific custom scripts, an attacker can trigger a memory error. This results in a denial of service, potentially disrupting internet name resolution for users and applications.

Technologies: [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-27854 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27854 being exploited in the wild.

**How severe is CVE-2026-27854?** Medium severity, with a CVSS score of 4.8, published 31 March 2026.

**Which products and versions are affected?** Powerdns Dnsdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2.

**Is there a fix for CVE-2026-27854?** A patch was published on 2026-03-31: First fixed versions released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27854 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27854?** Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (CWE-416) vulnerability exists in PowerDNS DNSdist when the DNSQuestion:getEDNSOptions method is used in custom Lua scripts. The flaw occurs because the method may refer to a version of a DNS packet that has already been modified or freed in memory. An unauthenticated remote attacker can exploit this by sending specially crafted DNS queries, though the attack requires a specific configuration (high complexity). Successful exploitation can lead to a process crash (Denial of Service) or potential information disclosure. The issue is fixed in versions 1.9.12 and 2.0.3.

## Affected products

- PowerDNS DNSdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2

## Timeline

- 2026-02-22: disclosed: Discovery date
- 2026-03-31: advisory: NVD and Vendor advisory published
- 2026-03-31: patched: First fixed versions released

## References

- [https://repo.powerdns.com/](https://repo.powerdns.com/)
- [https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html](https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html)

## Related threats

- [PowerDNS DNSdist EDNS options smuggling in EDNS processing](https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing)
- [PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3)
- [PowerDNS DNSdist out-of-bounds read in SetMacAddrAction](https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction)
- [PowerDNS DNSdist denial of service via IXFR queries](https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries)
- [PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries)