PowerDNS DNSdist Security Advisory: Multiple Vulnerabilities (HTMLi, InfoDisc, OOB, ACL Bypass)

PowerDNS Security Advisory 2026-02 for DNSdist Vulnerability Summary This security advisory addresses multiple vulnerabilities in PowerDNS DNSdist, affecting versions 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2. Unaffected versions are 1.9.12 and 2.0.3. The specific vulnerability details are as follows: 1. CVE-2026-0396: HTML injection in the web dashboard Vulnerability Overview: An attacker can trigger dynamic rules based on domain names by sending crafted DNS queries, thereby injecting HTML content into the internal web dashboard. Affected Versions: PowerDNS DNSdist 1.9.0 - 1.9.11, 2.0.0 - 2.0.2 Remediation: Upgrade to the patched version. 2. CVE-2026-0397: Information disclosure via CORS misconfiguration Vulnerability Overview: When the internal web server is enabled, an attacker can lure a logged-in dashboard administrator to visit a malicious website, thereby stealing the running configuration information from the dashboard. This is caused by improper Cross-Origin Resource Sharing (CORS) policy configuration. Affected Versions: PowerDNS DNSdist 1.9.0 - 1.9.11, 2.0.0 - 2.0.2 Remediation: Upgrade to the patched version, or disable the internal web server. 3. CVE-2026-24028: Out-of-bounds read when parsing DNS packets via Lua Vulnerability Overview: When custom Lua code uses to parse DNS packets, an attacker can trigger an out-of-bounds read by sending crafted DNS response packets. This may lead to crashes, denial of service, or potential information disclosure. Affected Versions: PowerDNS DNSdist 1.9.0 - 1.9.11, 2.0.0 - 2.0.2 Remediation: Upgrade to the patched version, or stop using . 4. CVE-2026-24029: DNS over HTTPS ACL bypass Vulnerability Overview: When the (Lua: ) option is disabled (enabled by default), ACL checks are skipped on the DNS over HTTPS (DoH) frontend provided by . This allows all clients to bypass configured ACLs to send DoH queries. Affected Versions: PowerDNS DNSdist 1.9.0 - 1.9.11, 2.0.0 - 2.0.2 Remediation: Upgrade to the patched version, or keep the option enabled. 5. CVE-2026-24030: Unbounded memory allocation for DoQ and DoH3 Vulnerability Overview: An attacker can induce DNSdist to allocate excessive memory when processing DoQ or DoH3 queries, leading to denial of service. In some cases, the system may enter an out-of-memory state and terminate the process. Affected Versions: PowerDNS DNSdist 1.9.0 - 1.9.11, 2.0.0 - 2.0.2 Remediation: Upgrade to the patched version. 6. CVE-2026-27854: Use after free when parsing EDNS options in Lua Vulnerability Overview: An attacker can trigger a use-after-free vulnerability by sending crafted DNS queries. In some cases, the method may reference a modified version of the DNS packet, triggering a use-after-free condition and causing denial of service. Affected Versions: PowerDNS DNSdist 1.9.0 - 1.9.11, 2.0.0 - 2.0.2 Remediation: Upgrade to the patched version, or avoid using . 7. CVE-2026-27853: Out-of-bounds write when rewriting large DNS packets Vulnerability Overview: An attacker can trigger an out-of-bounds write by sending crafted DNS responses. When using the or methods, if the rewritten packet is larger than the initial response and exceeds 65,535 bytes, it may cause a crash and lead to denial of service. Affected Versions: PowerDNS DNSdist 1.9.0 - 1.9.11, 2.0.0 - 2.0.2 Remediation**: Upgrade to the patched version, or avoid using or .

Goal Reached Thanks to every supporter — we hit 100%!

PowerDNS DNSdist Security Advisory: Multiple Vulnerabilities (HTMLi, InfoDisc, OOB, ACL Bypass)