CVE-2026-27854 MEDIUM

CVE-2026-27854: Use after free when parsing EDNS options in Lua

Vendor Powerdns
Product DNSdist
Published March 31, 2026
Last update April 2, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

What the vulnerability does

01Description

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Key dates

02Disclosure timeline

March 31, 2026 CVE published
April 2, 2026 Record updated