Every CVE Search/ Get API key

CVE-2026-27854

Use after free when parsing EDNS options in Lua

4.8 MediumFix available

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.49%Up 0.5 points since Apr 1, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

Use after free when parsing EDNS options in Lua

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Record
CVE-2026-27854
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-17409 4.8

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Record
EUVD-2026-17409
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-fmwh-v9r8-w9j6 4.8

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist...

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Record
GHSA-fmwh-v9r8-w9j6
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-416
Updated
2026-11-02
NVD 4.8

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Record
CVE-2026-27854
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2026-27854 7.5

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Record
ALPINE-CVE-2026-27854
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 4.8

Use after free when parsing EDNS options in Lua

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Record
CVE-2026-27854
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2026-27854 7.5

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Record
DEBIAN-CVE-2026-27854
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-27854 4.8

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Record
UBUNTU-CVE-2026-27854
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10473-1 No score

dnsdist-2.0.3-1.1 on GA media

These are all security issues fixed in the dnsdist-2.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10473-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21015-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
openSUSE-SU-2026:21015-1
Updated
2026-11-02
OSVSUSE-SU-2026:1618-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues:

Update to version 1.9.12.

Security issues fixed:

  • CVE-2026-0396: crafted DNS queries triggering domain-based dynamic rules can lead to HTML injection in the web dashboard (bsc#1261236).
  • CVE-2026-0397: misconfiguration of the CORS policy can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS packet parsed by Lua code using newDNSPacketOverlay can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: disabled option on a DNS over HTTPS nghttp2 frontend allows clients to bypass ACLs and send DoH queries (bsc#1261239).
  • CVE-2026-24030: crafted DoQ and DoH3 queries can lead to unbounded memory allocation and DoS (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses sent to a DNSdist using certain methods in custom Lua code (changeName) can lead to an out-of-bounds write (bsc#1261243).
  • CVE-2026-27854: crafted DNS queries sent to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code can lead to a use-after-free (bsc#1261241).
Record
SUSE-SU-2026:1618-1
Updated
2026-11-02
OSVSUSE-SU-2026:22319-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
SUSE-SU-2026:22319-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dnsdist
Alpine:v3.23
 1.9.0 up to 2.0.4-r0
2.0.4-r0
dnsdist
Alpine:v3.24
 1.9.0 up to 2.0.4-r0
2.0.4-r0
dnsdist
Debian:12
 All versions, plus listed versions
1.7.3-21.8.0-11.8.1-11.8.2-11.8.2-2
Show 32 moreShow less
1.8.2-31.8.3-11.8.3-21.8.3-31.9.10-11.9.3-11.9.4-11.9.5-11.9.6-11.9.8-11.9.9-12.0.0-12.0.0-22.0.0-32.0.0-42.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-12.1.0-12.1.0-22.1.1-12.1.2-1
 None known
dnsdist
Debian:13
 before 1.9.14-0+deb13u1, plus listed versions
1.9.10-11.9.10-1+deb13u1
1.9.14-0+deb13u1
dnsdist
Debian:14
 before 2.0.3-1, plus listed versions
1.9.10-12.0.0-12.0.0-22.0.0-32.0.0-4
Show 7 moreShow less
2.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-1
2.0.3-1
dnsdist
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 1.9.12-150700.3.9.1
1.9.12-150700.3.9.1
dnsdist
SUSE:Linux Enterprise Server 16.0
From an advisory covering 18 CVEs
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 18 CVEs
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.0~alpha2-1
 None known
dnsdist
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1
 None known
Show 8 moreShow less
Affected packages
PackageAffectedFixed
dnsdist
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.0~rc3-11.4.0-11.4.0-1build11.4.0-1build21.4.0-1ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.5.1-3build21.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2
 None known
dnsdist
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.8.0-11.8.2-11.8.2-21.8.2-31.8.3-1
Show 4 moreShow less
1.8.3-21.8.3-2build11.8.3-2build21.8.3-2ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:25.10
 All versions, plus listed versions
1.9.8-11.9.10-11.9.10-1ubuntu0.1
 None known
dnsdist
Ubuntu:26.10
 All versions, plus listed versions
2.0.2-1build12.0.5-2ubuntu12.0.5-2ubuntu3
 None known
dnsdist
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.9.10-12.0.1-12.0.2-12.0.2-1build1
 None known
dnsdist
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 2.0.3-1.1
2.0.3-1.1
dnsdist
openSUSE:Leap 16.0
From an advisory covering 18 CVEs
 before 1.9.13-160000.1.1
1.9.13-160000.1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27854 is a medium vulnerability (CVSS 4.8) in Powerdns Dnsdist, published March 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in dnsdist 2.0.4-r0.

References

Show 43 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open