Every CVE Search/ Get API key

CVE-2026-0396

HTML injection in the web dashboard

3.1 LowFix available

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.14%Up 0.1 points since Mar 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.1

HTML injection in the web dashboard

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Record
CVE-2026-0396
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
EUVDEUVD-2026-17361 3.1

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Record
EUVD-2026-17361
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-c6vq-q4cf-9cgj 3.1

An attacker might be able to inject HTML content into the internal web dashboard by sending...

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Record
GHSA-c6vq-q4cf-9cgj
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
NVD 3.1

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Record
CVE-2026-0396
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
OSVALPINE-CVE-2026-0396 4.3

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Record
ALPINE-CVE-2026-0396
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-03
OSV 3.1

HTML injection in the web dashboard

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Record
CVE-2026-0396
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2026-0396 4.3

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Record
DEBIAN-CVE-2026-0396
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-0396 3.1

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Record
UBUNTU-CVE-2026-0396
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:10473-1 No score

dnsdist-2.0.3-1.1 on GA media

These are all security issues fixed in the dnsdist-2.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10473-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21015-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
openSUSE-SU-2026:21015-1
Updated
2026-11-02
OSVSUSE-SU-2026:1618-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues:

Update to version 1.9.12.

Security issues fixed:

  • CVE-2026-0396: crafted DNS queries triggering domain-based dynamic rules can lead to HTML injection in the web dashboard (bsc#1261236).
  • CVE-2026-0397: misconfiguration of the CORS policy can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS packet parsed by Lua code using newDNSPacketOverlay can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: disabled option on a DNS over HTTPS nghttp2 frontend allows clients to bypass ACLs and send DoH queries (bsc#1261239).
  • CVE-2026-24030: crafted DoQ and DoH3 queries can lead to unbounded memory allocation and DoS (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses sent to a DNSdist using certain methods in custom Lua code (changeName) can lead to an out-of-bounds write (bsc#1261243).
  • CVE-2026-27854: crafted DNS queries sent to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code can lead to a use-after-free (bsc#1261241).
Record
SUSE-SU-2026:1618-1
Updated
2026-11-02
OSVSUSE-SU-2026:22319-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
SUSE-SU-2026:22319-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dnsdist
Alpine:v3.23
 1.9.0 up to 2.0.4-r0
2.0.4-r0
dnsdist
Alpine:v3.24
 1.9.0 up to 2.0.4-r0
2.0.4-r0
dnsdist
Debian:12
 All versions, plus listed versions
1.7.3-21.8.0-11.8.1-11.8.2-11.8.2-2
Show 32 moreShow less
1.8.2-31.8.3-11.8.3-21.8.3-31.9.10-11.9.3-11.9.4-11.9.5-11.9.6-11.9.8-11.9.9-12.0.0-12.0.0-22.0.0-32.0.0-42.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-12.1.0-12.1.0-22.1.1-12.1.2-1
 None known
dnsdist
Debian:13
 before 1.9.14-0+deb13u1, plus listed versions
1.9.10-11.9.10-1+deb13u1
1.9.14-0+deb13u1
dnsdist
Debian:14
 before 2.0.3-1, plus listed versions
1.9.10-12.0.0-12.0.0-22.0.0-32.0.0-4
Show 7 moreShow less
2.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-1
2.0.3-1
dnsdist
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.9.12-150700.3.9.1
1.9.12-150700.3.9.1
dnsdist
SUSE:Linux Enterprise Server 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.0~alpha2-1
 None known
dnsdist
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1
 None known
Show 8 moreShow less
Affected packages
PackageAffectedFixed
dnsdist
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.0~rc3-11.4.0-11.4.0-1build11.4.0-1build21.4.0-1ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.5.1-3build21.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2
 None known
dnsdist
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.8.0-11.8.2-11.8.2-21.8.2-31.8.3-1
Show 4 moreShow less
1.8.3-21.8.3-2build11.8.3-2build21.8.3-2ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:25.10
 All versions, plus listed versions
1.9.8-11.9.10-11.9.10-1ubuntu0.1
 None known
dnsdist
Ubuntu:26.10
 All versions, plus listed versions
2.0.2-1build12.0.5-2ubuntu12.0.5-2ubuntu3
 None known
dnsdist
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.9.10-12.0.1-12.0.2-12.0.2-1build1
 None known
dnsdist
openSUSE:Tumbleweed
 before 2.0.3-1.1
2.0.3-1.1
dnsdist
openSUSE:Leap 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-0396 is a low vulnerability (CVSS 3.1) in Powerdns Dnsdist, published March 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in dnsdist 2.0.4-r0.

References

Show 43 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open