Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-27853: dnsdist may crash on oversized DNS response packets

CVE-2026-27853 · published 7 months ago

Summary

The dnsdist DNS traffic manager (including the Debian, PowerDNS, and Canonical builds) can write data beyond the end of a memory buffer when custom Lua code rewrites large DNS responses. This can cause the service to stop working, denying DNS service to users. Apply the vendor’s latest update or disable the Lua rewrite functions that modify DNS packet names until the fix is in place.

What to do

Update debian dnsdist to version 1.9.14-0+deb13u1.
Update debian dnsdist to version 2.0.3-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	dnsdist	All versions
Debian:12	debian	dnsdist	All versions
Debian:13	debian	dnsdist	< 1.9.14-0+deb13u1 Fix: upgrade to 1.9.14-0+deb13u1
Debian:14	debian	dnsdist	< 2.0.3-1 Fix: upgrade to 2.0.3-1
–	powerdns	dnsdist	>= 1.9.0, < 1.9.12 >= 2.0.0, < 2.0.3 `cpe:2.3:a:powerdns:dnsdist::::::::`
Ubuntu:16.04:LTS	canonical	dnsdist	All versions

Original advisory text

Out-of-bounds write when rewriting large DNS packets

An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exceed 65535 bytes, potentially leading to a crash resulting in denial of service.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-0... Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-27853 Vendor Advisory
https://ubuntu.com/security/CVE-2026-27853 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-27853 Third Party Advisory
https://repo.powerdns.com/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27853... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-27853 Vendor Advisory
https://github.com/PowerDNS/pdns Product
https://downloads.powerdns.com/patches/2026-02/ Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published31 Mar 2026

Updated4 Nov 2026

First seen31 Mar 2026

Sources

CVE-2026-27853 · NVD

DEBIAN-CVE-2026-27853 · OSV

UBUNTU-CVE-2026-27853 · OSV

CVE-2026-27853 · OSV

Track software like this

Free during beta