OPENSUSE-SU-2026:21015-1: dnsdist security update

OPENSUSE-SU-2026:21015-1, released June 22, 2026, fixes 18 CVEs in dnsdist (version 1.9.13-160000.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

1 rated Critical

Exploited

None reported

Highest CVSS

9.1

Base score, 0 to 10

Highest EPSS

0.0107

65th percentile

Priority of the 18 CVEs

Patch now 0
                                Urgent 1
                                High 13
                                Routine 4

Fixed package versions

Product	Release	Fixed in
dnsdist	opensuse-leap 16.0	1.9.13-160000.1.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-33598	dnsdist: A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAdd...	9.1	0.0107	None reported
High	CVE-2026-24028	dnsdist: An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua...	8.2	0.0107	None reported
High	CVE-2026-33602	dnsdist: A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, t...	8.2	0.0073	None reported
High	CVE-2026-24030	dnsdist: An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over...	7.5	0.0056	None reported
High	CVE-2026-33260	dnsdist: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a d...	7.5	0.0052	None reported
High	CVE-2026-33257	dnsdist: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a d...	7.5	0.0051	None reported
High	CVE-2026-27853	dnsdist: An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the D...	7.5	0.0051	None reported
High	CVE-2026-27854	dnsdist: An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuesti...	7.5	0.0049	None reported
High	CVE-2026-33593	dnsdist: A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.	7.5	0.0038	None reported
High	CVE-2026-33254	dnsdist: An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in D...	7.5	0.0037	None reported
High	CVE-2026-33594	dnsdist: A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH...	7.5	0.0037	None reported
High	CVE-2026-33595	dnsdist: A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 c...	7.5	0.0037	None reported
High	CVE-2026-33597	dnsdist: PRSD detection denial of service	7.5	0.0035	None reported
High	CVE-2026-33599	dnsdist: A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via e...	8.1	0.0028	None reported
Routine	CVE-2026-33596	dnsdist: A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses...	6.5	0.0017	None reported
Routine	CVE-2026-0397	dnsdist: When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator log...	4.3	0.0017	None reported
Routine	CVE-2026-24029	dnsdist: When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend us...	6.5	0.0015	None reported
Routine	CVE-2026-0396	dnsdist: An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a...	4.3	0.0014	None reported

Also fixes CVE-2026-33598

SUSE-SU-2026:22319-1
dnsdist on sles 16.0
DEBIAN-CVE-2026-33598
dnsdist on Debian 13.5 (trixie), Debian 14

Vendor advisory

https://osv.dev/vulnerability/openSUSE-SU-2026:21015-1

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/opensuse-su-2026-21015-1">OPENSUSE-SU-2026:21015-1 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.