CVE-2026-27854 Use after free when parsing EDNS options in Lua

What is CVE-2026-27854?

CVE-2026-27854 is a medium-severity use after free vulnerability in PowerDNS DNSdist, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.

Weakness: CWE-416

Which versions are affected by CVE-2026-27854?

It affects 1 product.

Products include Powerdns Dnsdist.

How do I fix CVE-2026-27854?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-27854 being exploited?

There is no known exploitation of CVE-2026-27854 in the wild and no public exploit code.

Other vulnerabilities in PowerDNS DNSdist

• CVE-2017-7557 Cross-site request forgery in dnsdist High 8.8
• CVE-2026-33593 Denial of service via crafted DNSCrypt query High 7.5
• CVE-2026-33602 Off-by-one access when processing crafted UDP responses Medium 6.5
• CVE-2026-24029 DNS over HTTPS ACL bypass Medium 6.5
• CVE-2026-27853 Out-of-bounds write when rewriting large DNS packets Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-27854, GHSA-fmwh-v9r8-w9j6, UBUNTU-CVE-2026-27854.