PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-0396 PowerDNS CVE debrief

CVE-2026-0396 is a low-severity vulnerability in PowerDNS's DNSdist, allowing an attacker to inject HTML content into the internal web dashboard by sending crafted DNS queries when domain-based dynamic rules are enabled. The vulnerability has a CVSS score of 3.1 and exists when domain-based dynamic rules are enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI. This issue has been analyzed and has a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Administrators and security teams should review DNSdist configurations and monitor DNS queries for suspicious activity.

Vendor
PowerDNS
Product
DNSdist
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-25
Advisory published
2026-03-31
Advisory updated
2026-07-25

Who should care

Administrators and security teams responsible for DNS infrastructure, particularly those using PowerDNS's DNSdist, should be aware of this vulnerability. They should review and update DNSdist configurations to ensure domain-based dynamic rules are not unnecessarily enabled and monitor DNS queries for suspicious activity.

Technical summary

The vulnerability exists in DNSdist when domain-based dynamic rules are enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI. An attacker can inject HTML content by sending crafted DNS queries. This issue has been analyzed and has a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability affects PowerDNS's DNSdist and has a CVSS score of 3.1, indicating a low severity.

Defensive priority

Low priority due to the low CVSS score and the specific conditions required for exploitation.

Recommended defensive actions

  • Review and update DNSdist configurations to ensure domain-based dynamic rules are not unnecessarily enabled.
  • Monitor DNS queries for suspicious activity.
  • Apply patches or updates provided by PowerDNS as soon as they are available.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-03-31T12:16:27.190Z and last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. This vulnerability affects PowerDNS's DNSdist, particularly when domain-based dynamic rules are enabled. The evidence is based on the official CVE record and NVD entry. Defenders should verify the affected scope and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T12:16:27.190Z and has not been modified since then. The NVD entry is currently Analyzed.