{"id":"CVE-2018-14663","aliases":["DEBIAN-CVE-2018-14663","EUVD-2018-6558","GHSA-r2j7-9v32-854m","SUSE-SU-2023:2760-1","SUSE-SU-2023:2760-2","SUSE-SU-2023:2777-1","UBUNTU-CVE-2018-14663","openSUSE-SU-2024:12731-1"],"status":"published","title":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a...","description":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02572,"percentile":0.85272,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-11-26T22:00:00Z","modified":"2026-10-24T10:30:38Z","fixes":[{"ecosystem":"Debian:12","package":"dnsdist","fixed_in":["1.3.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dnsdist","fixed_in":["1.3.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dnsdist","fixed_in":["1.3.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0~alpha2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-1","1.2.0-3","1.2.1-1","1.2.1-1build1","1.2.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0~rc1-1.1"}]}],"bundled":2}],"products":[{"vendor":"[unknown]","product":"dnsdist"},{"vendor":"powerdns","product":"dnsdist"}],"references":[{"url":"https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2018-08.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14663","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14663"},{"url":"https://github.com/advisories/GHSA-r2j7-9v32-854m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-14663","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232760-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1054799","tags":["report"]},{"url":"https://bugzilla.suse.com/1054802","tags":["report"]},{"url":"https://bugzilla.suse.com/1114511","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14663","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232760-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232777-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-14663","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14663","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-14663","description":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.","status":"published","published":"2018-11-26T22:00:00Z","modified":"2024-08-05T09:38:12.94Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:00.589142Z"}],"euvd":[{"id":"EUVD-2018-6558","description":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.","status":"published","published":"2018-11-26T22:00:00Z","modified":"2024-08-05T09:38:12Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:46.259365Z"}],"ghsa":[{"id":"GHSA-r2j7-9v32-854m","title":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a...","description":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.","status":"published","published":"2022-05-13T01:34:29Z","modified":"2023-02-01T05:08:43Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:50.543713Z"}],"nvd":[{"id":"CVE-2018-14663","description":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.","status":"published","published":"2018-11-26T23:29:00.813Z","modified":"2026-06-17T01:41:24.3Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:48.987926Z"}],"osv":[{"id":"CVE-2018-14663","description":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.","status":"published","published":"2018-11-26T23:29:00.813Z","modified":"2026-10-24T10:30:38.103800404Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-14663","description":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.","status":"published","published":"2018-11-26T23:29:00.813Z","modified":"2026-10-23T18:02:59.933392314Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-14663","description":"An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.","status":"published","published":"2018-11-26T23:29:00Z","modified":"2026-02-10T06:45:35.882911Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"openSUSE-SU-2024:12731-1","title":"dnsdist-1.8.0~rc1-1.1 on GA media","description":"These are all security issues fixed in the dnsdist-1.8.0~rc1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:36:47.909664Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:2760-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\n\n- update to 1.8.0\n  - Implements dnsdist in SLE15 (jsc#PED-3402)\n  - Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)\n\n- update to 1.2.0 (bsc#1054799, bsc#1054802)\n  This release also addresses two security issues of low severity, CVE-2016-7069 and CVE-2017-7557. The first issue can lead to a\n  denial of service on 32-bit if a backend sends crafted answers,\n  and the second to an alteration of dnsdist’s ACL if the API is\n  enabled, writable and an authenticated user is tricked into\n  visiting a crafted website. \n","status":"published","published":"2023-12-06T09:47:21Z","modified":"2026-02-04T04:04:28.442725Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2760-2","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\n\n- update to 1.8.0\n  - Implements dnsdist in SLE15 (jsc#PED-3402)\n  - Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)\n\n- update to 1.2.0 (bsc#1054799, bsc#1054802)\n  This release also addresses two security issues of low severity, CVE-2016-7069 and CVE-2017-7557. The first issue can lead to a\n  denial of service on 32-bit if a backend sends crafted answers,\n  and the second to an alteration of dnsdist’s ACL if the API is\n  enabled, writable and an authenticated user is tricked into\n  visiting a crafted website. \n","status":"published","published":"2023-12-06T09:47:21Z","modified":"2026-02-04T04:37:56.7693Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2777-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\n- Implements package 'dnsdist' with version 1.8.0 in SLE15. (jsc#PED-3402)\n- Downstream DNS resolver configuration should be chosen by the admin\n- Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)\n- Security fix: There is an issue that can lead to a denial of service on 32-bit if a backend sends crafted answers. (CVE-2016-7069, bsc#1054799)\n- Security fix: Alteration of dnsdist's ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website. (CVE-2017-7557, bsc#1054799)\n- SNMP support, exporting statistics and sending traps\n- Preventing the packet cache from ageing responses when deployed in\n- Various DNSCrypt-related fixes and improvements, including automatic key rotation\n  ","status":"published","published":"2023-07-04T08:39:57Z","modified":"2026-02-04T03:52:30.910743Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}