CVE-2026-0396
Low · 3.1CVSS
3.1
EPSS
0.1%
Published
Mar 31, 2026
CISA due date
—
The record
An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | dnsdist | 0 | 1.9.13-160000.1.1 |
| openSUSE:Tumbleweed | dnsdist | 0 | 2.0.3-1.1 |
Related vulnerabilities
- CVE-2026-33598 A cached crafted response can cause an out-of-bounds read if custom Lua code calls… Also affects dnsdist
- CVE-2026-33596 A client might theoretically be able to cause a mismatch between queries sent to a… Also affects dnsdist
- CVE-2026-33602 A rogue backend can send a crafted UDP response with a query ID off by one related to the… Also affects dnsdist
- CVE-2026-33599 A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers… Also affects dnsdist
- CVE-2026-33597 PRSD detection denial of service Also affects dnsdist
- CVE-2026-33254 An attacker can create a large number of concurrent DoQ or DoH3 connections, causing… Also affects dnsdist
- CVE-2026-33594 A client can trigger excessive memory allocation by generating a lot of queries that are… Also affects dnsdist
- CVE-2026-33595 A client can trigger excessive memory allocation by generating a lot of errors responses… Also affects dnsdist