# OPENSUSE-SU-2026:21015-1: dnsdist security update

OPENSUSE-SU-2026:21015-1, released June 22, 2026, fixes 18 CVEs in dnsdist (version 1.9.13-160000.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/opensuse-su-2026-21015-1
- Platform: Linux
- Released: Jun 22, 2026
- Priority: Urgent (Closes CVE-2026-33598, rated Critical)
- CVEs: 18, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2026:21015-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [dnsdist](https://patchblox.com/security/data/product/linux/dnsdist.md) | opensuse-leap 16.0 | 1.9.13-160000.1.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-33598](https://patchblox.com/security/data/cve/CVE-2026-33598.md) | Urgent | dnsdist: A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAdd... | 9.1 | 0.0107 |  |
| [CVE-2026-24028](https://patchblox.com/security/data/cve/CVE-2026-24028.md) | High | dnsdist: An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua... | 8.2 | 0.0107 |  |
| [CVE-2026-33602](https://patchblox.com/security/data/cve/CVE-2026-33602.md) | High | dnsdist: A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, t... | 8.2 | 0.0073 |  |
| [CVE-2026-24030](https://patchblox.com/security/data/cve/CVE-2026-24030.md) | High | dnsdist: An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over... | 7.5 | 0.0056 |  |
| [CVE-2026-33260](https://patchblox.com/security/data/cve/CVE-2026-33260.md) | High | dnsdist: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a d... | 7.5 | 0.0052 |  |
| [CVE-2026-33257](https://patchblox.com/security/data/cve/CVE-2026-33257.md) | High | dnsdist: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a d... | 7.5 | 0.0051 |  |
| [CVE-2026-27853](https://patchblox.com/security/data/cve/CVE-2026-27853.md) | High | dnsdist: An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the D... | 7.5 | 0.0051 |  |
| [CVE-2026-27854](https://patchblox.com/security/data/cve/CVE-2026-27854.md) | High | dnsdist: An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuesti... | 7.5 | 0.0049 |  |
| [CVE-2026-33593](https://patchblox.com/security/data/cve/CVE-2026-33593.md) | High | dnsdist: A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query. | 7.5 | 0.0038 |  |
| [CVE-2026-33254](https://patchblox.com/security/data/cve/CVE-2026-33254.md) | High | dnsdist: An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in D... | 7.5 | 0.0037 |  |
| [CVE-2026-33594](https://patchblox.com/security/data/cve/CVE-2026-33594.md) | High | dnsdist: A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH... | 7.5 | 0.0037 |  |
| [CVE-2026-33595](https://patchblox.com/security/data/cve/CVE-2026-33595.md) | High | dnsdist: A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 c... | 7.5 | 0.0037 |  |
| [CVE-2026-33597](https://patchblox.com/security/data/cve/CVE-2026-33597.md) | High | dnsdist: PRSD detection denial of service | 7.5 | 0.0035 |  |
| [CVE-2026-33599](https://patchblox.com/security/data/cve/CVE-2026-33599.md) | High | dnsdist: A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via e... | 8.1 | 0.0028 |  |
| [CVE-2026-33596](https://patchblox.com/security/data/cve/CVE-2026-33596.md) | Routine | dnsdist: A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses... | 6.5 | 0.0017 |  |
| [CVE-2026-0397](https://patchblox.com/security/data/cve/CVE-2026-0397.md) | Routine | dnsdist: When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator log... | 4.3 | 0.0017 |  |
| [CVE-2026-24029](https://patchblox.com/security/data/cve/CVE-2026-24029.md) | Routine | dnsdist: When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend us... | 6.5 | 0.0015 |  |
| [CVE-2026-0396](https://patchblox.com/security/data/cve/CVE-2026-0396.md) | Routine | dnsdist: An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a... | 4.3 | 0.0014 |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.