CVE-2026-24028
Out-of-Bounds Read in Open-Xchange Lua DNS Parsing Causes DoS
Publication date: 2026-03-31
Last updated on: 2026-04-14
Assigner: Open-Xchange
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| powerdns | dnsdist | From 1.9.0 (inc) to 1.9.12 (exc) |
| powerdns | dnsdist | From 2.0.0 (inc) to 2.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-126 | The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when an attacker sends a specially crafted DNS response packet that is processed by custom Lua code using the newDNSPacketOverlay function to parse DNS packets.
The crafted packet can trigger an out-of-bounds read, which means the code reads memory outside the intended buffer.
This out-of-bounds read can cause the program to crash, resulting in a denial of service, or it can access unrelated memory, potentially leading to information disclosure.
How can this vulnerability impact me? :
The vulnerability can impact you by causing a denial of service if the affected application crashes due to the out-of-bounds read.
Additionally, it may lead to information disclosure if the out-of-bounds read accesses memory containing sensitive data.