DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
PowerDNS: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-03-30
Ein Angreifer kann mehrere Schwachstellen in PowerDNS ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, um einen Denial of Service zu verursachen und potentiell Code auszuführen.
01
beschreibt (7)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-27854US | high7.5 | — | ||
An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQ… | ||||
| CVE-2026-27853US | high7.5 | — | ||
An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in cust… | ||||
| CVE-2026-24030US | high7.5 | — | ||
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups w… | ||||
| CVE-2026-24029US | medium6.5OT erhöht | — | ||
When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing al… | ||||
| CVE-2026-24028US | high8.2 | — | ||
An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-… | ||||
| CVE-2026-0397US | medium4.3 | — | ||
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extr… | ||||
| CVE-2026-0396US | medium4.3 | — | ||
An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been ena… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- PowerDNS Release Notes vom 2026-03-30external
- Debian Security Advisory DSA-6235 vom 2026-04-29external
- openSUSE Security Update OPENSUSE-SU-2026:10473-1 vom 2026-04-02external
- SUSE Security Update SUSE-SU-2026:1618-1 vom 2026-04-24external
- SUSE Security Update SUSE-SU-2026:22319-1 vom 2026-07-01external
- WID-SEC-W-2026-0932 - CSAF Versionself
- WID-SEC-2026-0932 - Portal Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan