CVE-2026-27854

HighCVSS 7.5/10Last modified Jul 25, 2026

Description

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
PowerDNS	DNSdist	>= 1.9.0, < 1.9.12; >= 2.0.0, < 2.0.3

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.htmlVendor Advisory

Timeline

Published: Mar 31, 2026
Last modified: Jul 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-278555.9Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in pa CVE-2026-278565.9Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine CVE-2026-278577.5Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client CVE-2026-278587.5Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacke CVE-2026-278595.3A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message ca CVE-2026-27869.8Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thun CVE-2026-278605.3If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially CVE-2026-278674.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who h CVE-2026-278686.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) wh CVE-2026-278696.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) wh CVE-2026-27879.8Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8 CVE-2026-278704.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who h