CVE-2026-24028: DNS Packet Parsing DoS Vulnerability

CVE-2026-24028 Overview

CVE-2026-24028 is an out-of-bounds read vulnerability in DNSdist that can be triggered when custom Lua code uses the newDNSPacketOverlay function to parse DNS packets. An attacker can exploit this vulnerability by sending a crafted DNS response packet, potentially causing a crash (denial of service) or accessing unrelated memory regions (information disclosure).

Critical Impact

This vulnerability enables remote attackers to trigger denial of service conditions or potentially leak sensitive memory contents through specially crafted DNS response packets when Lua-based packet parsing is in use.

Affected Products

• DNSdist installations using custom Lua code with newDNSPacketOverlay function
• Configurations parsing DNS packets via Lua overlays

Discovery Timeline

• 2026-03-31 - CVE-2026-24028 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-24028

Vulnerability Analysis

This vulnerability is classified as CWE-126 (Buffer Over-read), which occurs when a program reads data past the end of an intended buffer. In the context of DNSdist, the issue manifests when the newDNSPacketOverlay Lua function processes maliciously crafted DNS response packets without proper bounds checking.

The vulnerability affects the DNS packet parsing logic within custom Lua scripts. When an attacker sends a specially constructed DNS response, the parsing routine can read beyond the allocated buffer boundaries, accessing memory that was not intended to be part of the packet data.

Root Cause

The root cause lies in insufficient boundary validation within the newDNSPacketOverlay function when processing DNS packet structures. The function fails to properly verify that packet field lengths and offsets remain within the bounds of the received data buffer before attempting read operations. This allows crafted packets with malformed length fields or truncated data to trigger reads beyond the valid packet boundary.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker needs to send crafted DNS response packets to a DNSdist instance that uses custom Lua code calling newDNSPacketOverlay. The attack requires no user interaction and can be performed against any exposed DNSdist service with vulnerable Lua configurations.

The exploitation scenario typically involves:

1. Identifying a DNSdist instance with custom Lua packet parsing
2. Crafting a malicious DNS response with manipulated length fields or truncated sections
3. Sending the packet to trigger the out-of-bounds read condition
4. Observing either a service crash (DoS) or attempting to extract leaked memory contents

Detection Methods for CVE-2026-24028

Indicators of Compromise

• Unexpected DNSdist process crashes or restarts correlating with incoming DNS traffic
• Anomalous DNS response packets with malformed or unusual length fields in network captures
• Error logs indicating memory access violations or segmentation faults in DNSdist
• Unusual patterns of DNS responses from untrusted sources targeting the DNSdist instance

Detection Strategies

• Monitor DNSdist process stability and implement alerting on unexpected crashes or restarts
• Deploy network intrusion detection rules to identify malformed DNS packets with suspicious length fields
• Implement DNS traffic analysis to detect responses from unexpected or unauthorized DNS servers
• Review DNSdist logs for Lua script errors or exceptions related to packet parsing

Monitoring Recommendations

• Enable verbose logging for Lua script execution within DNSdist to capture parsing errors
• Implement DNS response validation at the network perimeter to filter malformed packets
• Monitor system memory usage and process state for DNSdist services
• Establish baseline DNS traffic patterns to identify anomalous response activity

How to Mitigate CVE-2026-24028

Immediate Actions Required

• Review all custom Lua configurations using newDNSPacketOverlay and assess exposure
• Apply vendor patches as soon as they become available from the DNSdist project
• Consider temporarily disabling or restricting Lua-based packet parsing if not critical to operations
• Implement network-level filtering to restrict DNS responses to trusted upstream resolvers only

Patch Information

Refer to the DNSdist Security Advisory for official patch information and updated versions that address this vulnerability. Organizations should prioritize applying the security update to all affected DNSdist deployments.

Workarounds

• Restrict the use of newDNSPacketOverlay in Lua scripts to only process DNS packets from trusted sources
• Implement additional input validation in Lua scripts before calling packet overlay functions
• Deploy DNSdist behind a filtering proxy that validates DNS packet structure before forwarding
• Limit network exposure of DNSdist instances to reduce the attack surface for remote exploitation

# Example: Restrict DNS sources in dnsdist configuration
# Add to dnsdist.conf to limit which sources can send DNS responses
addAction(NotRule(makeRule("trusted-dns-servers.example.com")), DropAction())

# Alternatively, restrict to specific IP ranges for upstream DNS
newServer({address="192.0.2.1", pool="trusted"})
setPoolServerPolicy(firstAvailable, "trusted")