Powerdns Dnsdist vulnerabilities, page 2
30 vulnerabilities
Known vulnerabilities in Powerdns Dnsdist, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-33254debiandnsdist+2
EPSS score0.80%
An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.CVE-2026-33598debiandnsdist+2EPSS score2.84%
A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.CVE-2026-33593debiandnsdist+2EPSS score0.82%
A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.CVE-2026-33597debiandnsdist+2EPSS score0.75%
PRSD detection denial of serviceCVE-2026-33260debiandnsdist+8EPSS score1.06%
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.CVE-2026-33595debiandnsdist+2EPSS score0.80%
A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.CVE-2026-33594debiandnsdist+2EPSS score0.80%
A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.CVE-2026-33257debiandnsdist+8EPSS score1.06%
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.CVE-2026-33599debiandnsdist+2EPSS score0.80%
A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.CVE-2026-33602debiandnsdist+2EPSS score1.18%
A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.