CVE-2026-27854

7.5 highEPSS 0.5%

High (7.5) in powerdns dnsdist. EPSS 0.5% chance of exploitation in the next 30 days.

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWE: CWE-416
Published: 2026-03-31
Modified: 2026-07-25
Record from: the NVD, synced 2026-10-19

Affected

powerdns:dnsdist

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html

Check your stack JSON