PatchTheCVEdnsdist vulnerabilities and fixes
Recent CVEs affecting dnsdist, with upgrade or downgrade steps. 11 tracked.
dnsdist has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-04-22. Highest priority: CVE-2026-33602 (score 41/100).
- CVE-2026-33257 MEDIUM 5.3 UPGRADE UPGRADE An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading
- CVE-2026-33597 LOW 3.7 UPGRADE PRSD detection denial of service
- CVE-2026-33602 MEDIUM 6.5 UPGRADE A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured v
- CVE-2026-33593 HIGH 7.5 UPGRADE A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.
- CVE-2026-33598 MEDIUM 4.8 UPGRADE A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or
- CVE-2026-33260 MEDIUM 5.3 UPGRADE UPGRADE An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading
- CVE-2026-33254 MEDIUM 5.3 UPGRADE An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocati
- CVE-2026-33594 MEDIUM 5.3 UPGRADE A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overload
- CVE-2026-33595 MEDIUM 5.3 UPGRADE A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and
- CVE-2026-33599 LOW 3.1 UPGRADE A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requeste
- CVE-2026-33596 LOW 3.1 UPGRADE A client might theoretically be able to cause a mismatch between queries sent to a backend and the received re
FAQ
How do I fix dnsdist vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dnsdist being exploited right now?
None of the tracked dnsdist CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dnsdist CVE should I patch first?
CVE-2026-33602 currently ranks highest (41/100): A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured v.