Dnsdist

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

Published: 2026-06-25T12:24:20.140Z
Updated: 2026-06-25T13:44:07.962Z

An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.

Published: 2026-06-25T12:23:55.585Z
Updated: 2026-06-25T13:45:02.430Z

An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.

Published: 2026-06-25T12:23:31.623Z
Updated: 2026-06-25T13:49:35.668Z

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.

Published: 2026-06-25T12:23:05.694Z
Updated: 2026-06-25T13:56:22.793Z

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.

Published: 2026-06-25T12:22:42.722Z
Updated: 2026-06-25T13:24:55.798Z