TI-2026-00258 Aliases CVE-2026-0396 GHSA-c6vq-q4cf-9cgj

HTML injection in the web dashboard

LOW 19CWE-80Published 2026-03-31 · Updated 2026-03-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-80.

Summary

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00141 3rd percentileScored 2026-11-07

Fix Fixed DNSdist (PowerDNS): 1.9.12, 2.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PowerDNS	DNSdist	1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3	1.9.12, 2.0.3	Patch available	CNA

DNSdist VendorPowerDNS Affected 1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3 Fixed in 1.9.12, 2.0.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:powerdns:dnsdist::::::::	1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3	Vulnerable	PowerDNS

cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:* Versions 1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3 Vulnerable ·PowerDNS

Remediation

Fix · CNA DNSdist (PowerDNS) Fixed in 1.9.12, 2.0.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-03-31
PowerDNS DNSdist 1.9.12, 2.0.3
7 records Highest priority Priority MEDIUM 2 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-19357 Out-of-bounds read when parsing DNS packets via LuaPriority MEDIUM 44
- TI-2026-19359 Unbounded memory allocation for DoQ and DoH3Priority MEDIUM 40
- TI-2026-19358 DNS over HTTPS ACL bypassPriority LOW 34
Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-0396
2026-10-03 Alias added: GHSA-c6vq-q4cf-9cgj

References

Advisory 1

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html

TI-2026-19357 Out-of-bounds read when parsing DNS packets via Lua CVSS 3.1HIGH 8.2
TI-2026-25980 Out-of-bounds read in cache inspection via Lua CVSS 3.1CRITICAL 9.1
TI-2026-19359 Unbounded memory allocation for DoQ and DoH3 CVSS 3.1HIGH 7.5
TI-2017-05198 dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. CVSS 3.0HIGH 8.8
TI-2016-06076 Improper input validation in Open-Xchange GmbH dnsdist CVSS 3.0HIGH 7.5
TI-2026-25977 DoQ/DoH3 excessive memory allocation CVSS 3.1HIGH 7.5

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences