# Powerdns Dnsdist vulnerabilities

Source: https://junglewise.ai/threats/technologies/dnsdist  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/dnsdist.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 24 vulnerabilities in Powerdns Dnsdist: 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-42004, was published on 25 June 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 24 (0 critical, 0 exploited in the wild)

## About Powerdns Dnsdist

A highly DNS-, DoS- and abuse-aware loadbalancer.

## Latest Powerdns Dnsdist vulnerabilities

- [CVE-2026-42004: PowerDNS DNSdist EDNS options smuggling in EDNS processing](https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing) (low, CVSS 3.7, published 25 Jun 2026)
- [CVE-2026-40211: PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3) (medium, CVSS 5.3, published 25 Jun 2026)
- [CVE-2026-40210: PowerDNS DNSdist out-of-bounds read in SetMacAddrAction](https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction) (medium, CVSS 4.8, published 25 Jun 2026)
- [CVE-2026-40209: PowerDNS DNSdist denial of service via IXFR queries](https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries) (medium, CVSS 5.3, published 25 Jun 2026)
- [CVE-2026-40208: PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries) (low, CVSS 3.7, published 25 Jun 2026)
- [CVE-2026-40011: PowerDNS DNSdist denial of service in Prometheus endpoint](https://junglewise.ai/threats/cve-2026-40011-powerdns-dnsdist-denial-of-service-in-prometheus-endpoint) (low, CVSS 3.7, published 25 Jun 2026)
- [CVE-2026-33602: A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value…](https://junglewise.ai/threats/cve-2026-33602-a-rogue-backend-can-send-a-crafted-udp-response-with-a-query-id) (medium, CVSS 6.5, published 22 Apr 2026)
- [CVE-2026-33599: A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via…](https://junglewise.ai/threats/cve-2026-33599-a-rogue-backend-can-send-a-crafted-svcb-response-to-a-discovery) (low, CVSS 3.1, published 22 Apr 2026)
- [CVE-2026-33598: A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or…](https://junglewise.ai/threats/cve-2026-33598-a-cached-crafted-response-can-cause-an-out-of-bounds-read-if) (medium, CVSS 4.8, published 22 Apr 2026)
- [CVE-2026-33597: PRSD detection denial of service](https://junglewise.ai/threats/cve-2026-33597-prsd-detection-denial-of-service) (low, CVSS 3.7, published 22 Apr 2026)
- [CVE-2026-33596: A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses…](https://junglewise.ai/threats/cve-2026-33596-a-client-might-theoretically-be-able-to-cause-a-mismatch-between) (low, CVSS 3.1, published 22 Apr 2026)
- [CVE-2026-33595: A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3…](https://junglewise.ai/threats/cve-2026-33595-a-client-can-trigger-excessive-memory-allocation-by-generating-a) (medium, CVSS 5.3, published 22 Apr 2026)
- [CVE-2026-33594: A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH…](https://junglewise.ai/threats/cve-2026-33594-a-client-can-trigger-excessive-memory-allocation-by-generating-a) (medium, CVSS 5.3, published 22 Apr 2026)
- [CVE-2026-33593: A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.](https://junglewise.ai/threats/cve-2026-33593-a-client-can-trigger-a-divide-by-zero-error-leading-to-crash-by) (high, CVSS 7.5, published 22 Apr 2026)
- [CVE-2026-33254: An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in…](https://junglewise.ai/threats/cve-2026-33254-an-attacker-can-create-a-large-number-of-concurrent-doq-or-doh3) (medium, CVSS 5.3, published 22 Apr 2026)
- [CVE-2026-33260: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33260-an-attacker-can-send-a-web-request-that-causes-unlimited-memory) (medium, CVSS 5.3, published 22 Apr 2026)
- [CVE-2026-33257: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33257-an-attacker-can-send-a-web-request-that-causes-unlimited-memory) (medium, CVSS 5.3, published 22 Apr 2026)
- [CVE-2026-27854: PowerDNS DNSdist use-after-free in DNSQuestion:getEDNSOptions](https://junglewise.ai/threats/cve-2026-27854-powerdns-dnsdist-use-after-free-in-dnsquestion-getednsoptions) (medium, CVSS 4.8, published 31 Mar 2026)
- [CVE-2026-27853: PowerDNS DNSdist out-of-bounds write in changeName Lua methods](https://junglewise.ai/threats/cve-2026-27853-powerdns-dnsdist-out-of-bounds-write-in-changename-lua-methods) (medium, CVSS 5.9, published 31 Mar 2026)
- [CVE-2026-24030: PowerDNS DNSdist denial of service via unbounded memory allocation in DoQ and DoH3](https://junglewise.ai/threats/cve-2026-24030-powerdns-dnsdist-denial-of-service-via-unbounded-memory) (medium, CVSS 5.3, published 31 Mar 2026)
- [CVE-2026-24029: PowerDNS DNSdist ACL bypass in DNS over HTTPS frontend](https://junglewise.ai/threats/cve-2026-24029-powerdns-dnsdist-acl-bypass-in-dns-over-https-frontend) (medium, CVSS 6.5, published 31 Mar 2026)
- [CVE-2026-24028: PowerDNS DNSdist out-of-bounds read in Lua DNS packet parsing](https://junglewise.ai/threats/cve-2026-24028-powerdns-dnsdist-out-of-bounds-read-in-lua-dns-packet-parsing) (medium, CVSS 5.3, published 31 Mar 2026)
- [CVE-2026-0397: PowerDNS DNSdist information disclosure via CORS misconfiguration in dashboard](https://junglewise.ai/threats/cve-2026-0397-powerdns-dnsdist-information-disclosure-via-cors-misconfiguration) (low, CVSS 3.1, published 31 Mar 2026)
- [CVE-2026-0396: PowerDNS DNSdist HTML injection in web dashboard](https://junglewise.ai/threats/cve-2026-0396-powerdns-dnsdist-html-injection-in-web-dashboard) (low, CVSS 3.1, published 31 Mar 2026)

## Most severe Powerdns Dnsdist vulnerabilities

- [CVE-2026-33593: A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.](https://junglewise.ai/threats/cve-2026-33593-a-client-can-trigger-a-divide-by-zero-error-leading-to-crash-by) (high, CVSS 7.5, published 22 Apr 2026)
- [CVE-2026-33602: A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value…](https://junglewise.ai/threats/cve-2026-33602-a-rogue-backend-can-send-a-crafted-udp-response-with-a-query-id) (medium, CVSS 6.5, published 22 Apr 2026)
- [CVE-2026-24029: PowerDNS DNSdist ACL bypass in DNS over HTTPS frontend](https://junglewise.ai/threats/cve-2026-24029-powerdns-dnsdist-acl-bypass-in-dns-over-https-frontend) (medium, CVSS 6.5, published 31 Mar 2026)
- [CVE-2026-27853: PowerDNS DNSdist out-of-bounds write in changeName Lua methods](https://junglewise.ai/threats/cve-2026-27853-powerdns-dnsdist-out-of-bounds-write-in-changename-lua-methods) (medium, CVSS 5.9, published 31 Mar 2026)
- [CVE-2026-24028: PowerDNS DNSdist out-of-bounds read in Lua DNS packet parsing](https://junglewise.ai/threats/cve-2026-24028-powerdns-dnsdist-out-of-bounds-read-in-lua-dns-packet-parsing) (medium, CVSS 5.3, published 31 Mar 2026)
- [CVE-2026-24030: PowerDNS DNSdist denial of service via unbounded memory allocation in DoQ and DoH3](https://junglewise.ai/threats/cve-2026-24030-powerdns-dnsdist-denial-of-service-via-unbounded-memory) (medium, CVSS 5.3, published 31 Mar 2026)
- [CVE-2026-33260: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33260-an-attacker-can-send-a-web-request-that-causes-unlimited-memory) (medium, CVSS 5.3, published 22 Apr 2026)
- [CVE-2026-33257: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33257-an-attacker-can-send-a-web-request-that-causes-unlimited-memory) (medium, CVSS 5.3, published 22 Apr 2026)
- [CVE-2026-33595: A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3…](https://junglewise.ai/threats/cve-2026-33595-a-client-can-trigger-excessive-memory-allocation-by-generating-a) (medium, CVSS 5.3, published 22 Apr 2026)
- [CVE-2026-33594: A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH…](https://junglewise.ai/threats/cve-2026-33594-a-client-can-trigger-excessive-memory-allocation-by-generating-a) (medium, CVSS 5.3, published 22 Apr 2026)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Powerdns technologies

- [Powerdns Recursor](https://junglewise.ai/threats/technologies/recursor): 19 vulnerabilities
- [PowerDNS Authoritative Server](https://junglewise.ai/threats/technologies/authoritative-server): 7 vulnerabilities
- [Powerdns Authoritative](https://junglewise.ai/threats/technologies/authoritative): 5 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Powerdns Dnsdist vulnerabilities", https://junglewise.ai/threats/technologies/dnsdist, 9 November 2026.