CVE-2026-33595

dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.

An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.

An attacker can trigger a use-after-free in DNSdist by sending crafted DNS queries when using the DNSQuestion:getEDNSOptions method in custom Lua code. This can lead to a crash and denial of service.

An attacker can trigger an out-of-bounds write in DNSdist by sending crafted DNS responses when using DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. The rewritten packet may exceed 65535 bytes, causing a crash and denial of service.

An attacker can trick DNSdist into allocating excessive memory while processing DNS over QUIC or HTTP/3 payloads, causing a denial of service. In some cases the system may run out of memory and terminate the process.

When the internal webserver is enabled (default is disabled), an attacker might trick an administrator into visiting a malicious website and extract configuration information. The root cause is a misconfigured CORS policy.

An attacker can inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance with domain-based dynamic rules enabled.