CVE-2026-27854
Medium · 4.8CVSS
4.8
EPSS
1.3%
Published
Mar 31, 2026
CISA due date
—
The record
An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | dnsdist | 0 | 1.9.13-160000.1.1 |
| openSUSE:Tumbleweed | dnsdist | 0 | 2.0.3-1.1 |
Related vulnerabilities
- CVE-2026-33598 A cached crafted response can cause an out-of-bounds read if custom Lua code calls… Also affects dnsdist
- CVE-2026-33596 A client might theoretically be able to cause a mismatch between queries sent to a… Also affects dnsdist
- CVE-2026-33602 A rogue backend can send a crafted UDP response with a query ID off by one related to the… Also affects dnsdist
- CVE-2026-33599 A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers… Also affects dnsdist
- CVE-2026-33597 PRSD detection denial of service Also affects dnsdist
- CVE-2026-33254 An attacker can create a large number of concurrent DoQ or DoH3 connections, causing… Also affects dnsdist
- CVE-2026-33594 A client can trigger excessive memory allocation by generating a lot of queries that are… Also affects dnsdist
- CVE-2026-33595 A client can trigger excessive memory allocation by generating a lot of errors responses… Also affects dnsdist