CVE-2026-24028
Published: 31 March 2026
Summary
CVE-2026-24028 is a medium-severity Buffer Over-read (CWE-126) vulnerability in Powerdns Dnsdist. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through patching dnsdist per the PowerDNS advisory directly eliminates the out-of-bounds read vulnerability exploited by crafted DNS response packets.
Memory protection mechanisms such as address space layout randomization and stack canaries prevent out-of-bounds reads from accessing unrelated memory or causing exploitable crashes.
Information input validation ensures crafted DNS packets are checked for validity before processing by custom Lua code using newDNSPacketOverlay, mitigating malformed inputs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct network exploitation of public-facing dnsdist DNS load balancer via crafted packets matches T1190.
NVD Description
An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service,…
more
or access unrelated memory, leading to potential information disclosure.
Deeper analysisAI
CVE-2026-24028 is an out-of-bounds read vulnerability (CWE-126) affecting dnsdist, the DNS load balancer from PowerDNS. The issue arises when custom Lua code in dnsdist uses the newDNSPacketOverlay function to parse DNS packets, enabling an attacker to trigger the vulnerability by sending a crafted DNS response packet. Published on 2026-03-31, it carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), indicating medium severity primarily due to low-impact availability effects.
An unauthenticated attacker with network access to the dnsdist instance can exploit this by transmitting a specially crafted DNS response packet. Successful exploitation triggers an out-of-bounds read, which may cause a crash resulting in denial of service or allow access to unrelated memory, potentially leading to information disclosure.
Mitigation details are provided in the official PowerDNS security advisory for dnsdist at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html.
Details
- CWE(s)