CVE-2026-27854: 
NixOS vulnerability analysis and mitigation

CVE-2026-27854 is a use-after-free vulnerability in PowerDNS DNSdist that can be triggered by sending crafted DNS queries to instances using the DNSQuestion:getEDNSOptions method in custom Lua code. When getEDNSOptions references a version of the DNS packet that has already been modified, a use-after-free condition is triggered, potentially causing a crash and denial of service. The vulnerability was disclosed on March 31, 2026, and affects DNSdist versions 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2. NVD assigns a CVSS v3.1 base score of 7.5 (High), while the CNA (Open-Xchange) scores it 4.8 (Medium) (GitHub Advisory, DNSdist Advisory).

The root cause is a use-after-free (CWE-416) combined with an expired pointer dereference (CWE-825) in DNSdist's Lua integration layer. When custom Lua code invokes DNSQuestion:getEDNSOptions, the method may hold a reference to a DNS packet buffer that has since been modified or reallocated; subsequent access to that stale pointer constitutes the use-after-free. The attack is network-based, requires no authentication or user interaction, and is only exploitable on DNSdist instances that have custom Lua rules calling DNSQuestion:getEDNSOptions — deployments without such Lua code are not affected. No public proof-of-concept code has been identified (DNSdist Advisory, GitHub Advisory).

Successful exploitation causes DNSdist to crash, resulting in a denial of service for all DNS traffic routed through the affected instance. Because DNSdist is commonly deployed as a DNS load balancer or front-end proxy, a crash can disrupt DNS resolution for downstream clients and services. The CNA scoring also notes a low confidentiality impact, suggesting that memory contents could potentially be disclosed in some crash scenarios, though this is considered a secondary risk (DNSdist Advisory, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit as of the time of disclosure. The EPSS score is approximately 0.009% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement that the target DNSdist instance must be running custom Lua code that calls DNSQuestion:getEDNSOptions (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify internet-facing or network-accessible DNSdist instances running versions 1.9.0–1.9.11 or 2.0.0–2.0.2 using DNS probing tools or service banners.
2. Confirm Lua usage: Determine whether the target instance uses custom Lua rules invoking DNSQuestion:getEDNSOptions — this may be inferred from observed DNS behavior or configuration leaks.
3. Craft malicious DNS query: Construct a DNS query with EDNS options designed to trigger packet modification during processing, causing the internal DNS packet buffer to be reallocated before getEDNSOptions completes its reference.
4. Send crafted query: Transmit the crafted DNS query to the DNSdist listener (typically UDP/TCP port 53) from any network-accessible host — no credentials are required.
5. Trigger use-after-free: The modified packet buffer causes DNSQuestion:getEDNSOptions to dereference a freed or reallocated memory region, resulting in a crash and denial of service of the DNSdist process (DNSdist Advisory).

• Logs: Unexpected DNSdist process crashes or restarts logged in system journals (journalctl -u dnsdist) or DNSdist log files; error messages referencing memory access violations or segmentation faults.
• Process: DNSdist process terminating abnormally and being restarted by a service manager (e.g., systemd); core dump files generated in the DNSdist working directory.
• Network: Repeated DNS queries with unusual or malformed EDNS option fields originating from a single source IP targeting the DNSdist listener port (UDP/TCP 53 or configured port); sudden spike in DNS query volume from unexpected sources.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the DNSdist working directory following a crash event.

PowerDNS has released patched versions DNSdist 1.9.12 and DNSdist 2.0.3, which resolve this vulnerability; upgrading to these versions is the recommended remediation (DNSdist Advisory, PowerDNS Blog). As a workaround where immediate patching is not possible, administrators should review and remove or refactor any custom Lua code that calls DNSQuestion:getEDNSOptions, as the vulnerability is only exploitable when this method is in use. Additionally, restricting DNS query access to trusted source IPs via network-level ACLs can reduce exposure until patching is completed.

The PowerDNS team published a release announcement and security advisory simultaneously with the CVE disclosure on March 31, 2026, indicating proactive vendor communication (PowerDNS Blog). The vulnerability was discussed on the oss-security mailing list shortly after disclosure (oss-sec). Downstream distributions including openSUSE, Fedora, Debian, and FreeBSD subsequently issued their own security updates for the dnsdist package, reflecting broad ecosystem awareness and response.