CVE-2026-24028: 
NixOS vulnerability analysis and mitigation

CVE-2026-24028 is a buffer over-read vulnerability in PowerDNS dnsdist that allows a remote, unauthenticated attacker to trigger an out-of-bounds read by sending a crafted DNS response packet when custom Lua code uses the newDNSPacketOverlay function to parse DNS packets. It affects dnsdist versions 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2. The vulnerability was disclosed on March 31, 2026, with patches released the same day. Feedly assigns a CVSS v3.1 base score of 8.2 (High), while the GitHub Advisory and ENISA rate it at 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla, PowerDNS Advisory).

The root cause is improper validation of a specified quantity in input (CWE-1284) combined with a buffer over-read (CWE-126), occurring in the newDNSPacketOverlay Lua API function used to parse DNS packets. When a crafted DNS response packet with malformed length or offset fields is processed by this function, the parser reads beyond the intended buffer boundary. Exploitation requires that the target dnsdist instance is running custom Lua code that invokes newDNSPacketOverlay — this is not a default configuration, limiting the attack surface to deployments with such customizations. No public proof-of-concept code has been identified (GitHub Advisory, PowerDNS Advisory).

Successful exploitation can result in two outcomes: a crash of the dnsdist service causing denial of service, or an out-of-bounds memory read that may expose unrelated memory contents, leading to potential information disclosure. The attack is network-accessible and requires no authentication or user interaction, making it exploitable by any remote attacker who can send DNS response packets to the affected instance. Integrity is not impacted, but availability and confidentiality are at risk for affected deployments (Red Hat Bugzilla, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement that the target must be running custom Lua code using newDNSPacketOverlay (GitHub Advisory, PowerDNS Advisory).

PowerDNS released patched versions on March 31, 2026: upgrade to dnsdist 1.9.12 (for the 1.9.x branch) or 2.0.3 (for the 2.0.x branch). As a workaround, administrators should review and remove or restrict custom Lua code that uses newDNSPacketOverlay, or restrict network access to dnsdist instances to trusted sources only. Downstream distributions including Fedora, openSUSE, Debian, and FreeBSD have also released updated packages (PowerDNS Advisory, GitHub Advisory, Red Hat Bugzilla).

PowerDNS published a coordinated security advisory and release announcement on March 31, 2026, the same day the CVE was disclosed, indicating a well-managed disclosure process. Red Hat tracked the issue via Bugzilla with a high severity rating. The vulnerability was picked up by downstream Linux distributions (Fedora, openSUSE, Debian, FreeBSD) relatively quickly, with security updates issued within days to weeks of the initial disclosure (PowerDNS Blog, Red Hat Bugzilla).