Ilya Rozentsvaig

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, keep the internal web server disabled.

**Name of the Vulnerable Software and Affected Versions** DNSdist (affected versions not specified) **Description** An attacker can trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist instance using custom Lua code. The issue occurs when utilizing the `DNSQuestion:changeName` or `DNSResponse:changeName` methods. In certain scenarios, the rewritten packet may exceed the size of the initial response or surpass 65535 bytes, which can lead to a system crash and subsequent denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.