Read the docs
TI-2018-10526 Aliases CVE-2018-14663GHSA-r2j7-9v32-854m

Improper input validation in [UNKNOWN] dnsdist

Priority LOW 31CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.

Why it matters now

EPSS 0.02572 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]dnsdist1.3.3—No fix listedCNA
  • dnsdist Vendor[UNKNOWN] Affected 1.3.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:*up to 1.3.2VulnerablePowerDNS
  • cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:* Versions up to 1.3.2 Vulnerable ·PowerDNS

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-14663
  2. 2026-10-03 Alias added: GHSA-r2j7-9v32-854m

References

Advisory 2

  • TI-2026-19357 Out-of-bounds read when parsing DNS packets via Lua CVSS 3.1HIGH 8.2
  • TI-2026-25980 Out-of-bounds read in cache inspection via Lua CVSS 3.1CRITICAL 9.1
  • TI-2026-19359 Unbounded memory allocation for DoQ and DoH3 CVSS 3.1HIGH 7.5
  • TI-2017-05198 dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. CVSS 3.0HIGH 8.8
  • TI-2016-06076 Improper input validation in Open-Xchange GmbH dnsdist CVSS 3.0HIGH 7.5
  • TI-2026-25977 DoQ/DoH3 excessive memory allocation CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences