CVE-2026-27853

Name of the Vulnerable Software and Affected Versions DNSdist (affected versions not specified)

Description An attacker can trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist instance using custom Lua code. The issue occurs when utilizing the DNSQuestion:changeName or DNSResponse:changeName methods. In certain scenarios, the rewritten packet may exceed the size of the initial response or surpass 65535 bytes, which can lead to a system crash and subsequent denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.