TI-2026-22204 Aliases CVE-2026-27854 GHSA-fmwh-v9r8-w9j6

Use after free when parsing EDNS options in Lua

LOW 33CWE-416Published 2026-03-31 · Updated 2026-04-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00489 42nd percentileScored 2026-11-07

Fix Fixed DNSdist (PowerDNS): 1.9.12, 2.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PowerDNS	DNSdist	1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3	1.9.12, 2.0.3	Patch available	CNA

DNSdist VendorPowerDNS Affected 1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3 Fixed in 1.9.12, 2.0.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:powerdns:dnsdist::::::::	1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3	Vulnerable	PowerDNS

cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:* Versions 1.9.0 to before 1.9.12; 2.0.0 to before 2.0.3 Vulnerable ·PowerDNS

Remediation

Fix · CNA DNSdist (PowerDNS) Fixed in 1.9.12, 2.0.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-03-31
PowerDNS DNSdist 1.9.12, 2.0.3
7 records Highest priority Priority MEDIUM 2 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-19357 Out-of-bounds read when parsing DNS packets via LuaPriority MEDIUM 44
- TI-2026-19359 Unbounded memory allocation for DoQ and DoH3Priority MEDIUM 40
- TI-2026-19358 DNS over HTTPS ACL bypassPriority LOW 34
Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-27854
2026-10-03 Alias added: GHSA-fmwh-v9r8-w9j6
2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html

TI-2026-19357 Out-of-bounds read when parsing DNS packets via Lua CVSS 3.1HIGH 8.2
TI-2026-25980 Out-of-bounds read in cache inspection via Lua CVSS 3.1CRITICAL 9.1
TI-2026-19359 Unbounded memory allocation for DoQ and DoH3 CVSS 3.1HIGH 7.5
TI-2017-05198 dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. CVSS 3.0HIGH 8.8
TI-2016-06076 Improper input validation in Open-Xchange GmbH dnsdist CVSS 3.0HIGH 7.5
TI-2026-25977 DoQ/DoH3 excessive memory allocation CVSS 3.1HIGH 7.5

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences