CVE-2026-24028 Powerdns CVE debrief

Who should care

Users of Powerdns Dnsdist versions 1.9.0-1.9.12 and 2.0.0-2.0.3 should apply patches to prevent potential out-of-bounds reads. This includes operators of Powerdns Dnsdist, security teams, and vulnerability management teams who need to assess and mitigate this vulnerability.

Technical summary

An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access unrelated memory, leading to potential information disclosure. This vulnerability affects Powerdns Dnsdist versions 1.9.0-1.9.12 and 2.0.0-2.0.3.

Defensive priority

Medium priority due to potential for denial of service and information disclosure.

Recommended defensive actions

• Apply patches for Powerdns Dnsdist versions 1.9.0-1.9.12 and 2.0.0-2.0.3
• Restrict access to DNS packet parsing functionality
• Monitor for suspicious DNS traffic
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-03-31T12:16:27.487Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Powerdns Dnsdist versions 1.9.0-1.9.12 and 2.0.0-2.0.3. Users should verify their deployments and apply patches or mitigations as necessary.

Official resources