CVE-2026-27853: 
NixOS vulnerability analysis and mitigation

CVE-2026-27853 is an out-of-bounds write vulnerability in PowerDNS DNSdist that allows a remote, unauthenticated attacker to trigger a denial of service by sending crafted DNS responses. The flaw affects DNSdist versions 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2, and is only exploitable when custom Lua code uses the DNSQuestion:changeName or DNSResponse:changeName methods. The vulnerability was disclosed on March 31, 2026, and assigned by Open-Xchange (PowerDNS). NIST NVD rates it 7.5 (High) under CVSS v3.1, while the CNA (Open-Xchange) rates it 5.9 (Medium) due to higher assessed attack complexity (GitHub Advisory, DNSdist Advisory).

The root cause is an out-of-bounds write (CWE-787) in DNSdist's DNS packet rewriting logic. When custom Lua code invokes DNSQuestion:changeName or DNSResponse:changeName, the rewritten DNS packet may grow beyond the size of the original response buffer — in some cases exceeding the maximum DNS UDP packet size of 65,535 bytes — without adequate bounds checking. This memory corruption can cause the DNSdist process to crash. The attack vector is network-based, requires no authentication or user interaction, and is only triggered when the specific Lua methods are present in the deployed configuration (DNSdist Advisory, GitHub Advisory).

Successful exploitation results in a crash of the DNSdist process, causing a denial of service and making the DNS load balancer unavailable to clients. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Environments relying on DNSdist as a critical DNS proxy or load balancer could experience significant service disruption until the process is restarted or patched (DNSdist Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (3rd percentile), indicating a very low probability of exploitation in the near term. Exploitation requires that the target DNSdist instance be configured with custom Lua code using the vulnerable changeName methods, which limits the attack surface (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible DNSdist instances running versions 1.9.0–1.9.11 or 2.0.0–2.0.2 that are configured with custom Lua code using DNSQuestion:changeName or DNSResponse:changeName.
2. Craft malicious DNS response: Prepare a DNS response packet designed so that, after name rewriting by the Lua code, the resulting packet size exceeds the original buffer allocation — potentially surpassing 65,535 bytes.
3. Deliver crafted response: Send the crafted DNS response to the DNSdist instance, either by acting as a malicious upstream DNS resolver or by intercepting/injecting DNS traffic in a position to influence responses seen by DNSdist.
4. Trigger out-of-bounds write: The changeName method processes the oversized name, writing beyond the intended buffer boundary, corrupting memory.
5. Achieve denial of service: The memory corruption causes DNSdist to crash, resulting in service unavailability until the process is restarted (DNSdist Advisory).

• Logs: Unexpected DNSdist process crash logs or core dump files; service restart events in system logs (e.g., systemd reporting DNSdist unit restarted).
• Process: Sudden termination of the dnsdist process without administrative action; repeated process restarts in a short time window.
• Network: Unusual DNS response traffic from upstream resolvers containing abnormally large or malformed DNS name fields directed at the DNSdist instance.
• File System: Core dump files generated in the DNSdist working directory following a crash.

PowerDNS has released patched versions DNSdist 1.9.12 and DNSdist 2.0.3, which address this vulnerability. Administrators should upgrade immediately if their deployment uses custom Lua code with DNSQuestion:changeName or DNSResponse:changeName. As a temporary workaround, review and disable or remove Lua configurations that use these methods, and implement network-level access controls to restrict which upstream resolvers can send DNS responses to DNSdist. Fedora and Debian packages have also been updated (DNSdist Advisory, PowerDNS Blog).

PowerDNS published a release announcement and security advisory simultaneously on March 31, 2026, covering both the 1.9.12 and 2.0.3 releases (PowerDNS Blog). Red Hat tracked the issue via Bugzilla and assessed it as medium severity (Red Hat Bugzilla). Downstream distributions including Fedora, Debian, and FreeBSD issued updated packages shortly after the disclosure. No significant social media controversy or notable independent researcher commentary has been observed.