An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1618-1 advisory.

    Update to version 1.9.12.

    - https://www.dnsdist.org/changelog.html#change-1.9.12

    Security issues fixed:

    - CVE-2026-0396: crafted DNS queries triggering domain-based dynamic rules can lead to HTML injection in     the web       dashboard (bsc#1261236).
    - CVE-2026-0397: misconfiguration of the CORS policy can lead to information disclosure (bsc#1261237).
    - CVE-2026-24028: crafted DNS packet parsed by Lua code using `newDNSPacketOverlay` can lead to an out-of-     bounds read       (bsc#1261238).
    - CVE-2026-24029: disabled option on a DNS over HTTPS nghttp2 frontend allows clients to bypass ACLs and     send DoH       queries (bsc#1261239).
    - CVE-2026-24030: crafted DoQ and DoH3 queries can lead to unbounded memory allocation and DoS     (bsc#1261240).
    - CVE-2026-27853: crafted DNS responses sent to a DNSdist using certain methods in custom Lua code     (`changeName`) can       lead to an out-of-bounds write (bsc#1261243).
    - CVE-2026-27854: crafted DNS queries sent to a DNSdist using the `DNSQuestion:getEDNSOptions` method in     custom Lua       code can lead to a use-after-free (bsc#1261241).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-637c11815f advisory.

    Update to latest upstream

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6cae4711b3 advisory.

    Update to latest upstream

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 431c2753-3503-11f1-bc6d-3c7c3fba4204 advisory.

    https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC     or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory     available this usually results in an exception and the QUIC connection is properly closed, but in some     cases the system might enter an out-of-memory state instead and terminate the process. (CVE-2026-24030)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310228	SUSE SLED15 / SLES15 Security Update : dnsdist (SUSE-SU-2026:1618-1)	Nessus	SuSE Local Security Checks	high
307046	Fedora 42 : dnsdist (2026-637c11815f)	Nessus	Fedora Local Security Checks	high
307044	Fedora 43 : dnsdist (2026-6cae4711b3)	Nessus	Fedora Local Security Checks	high
305995	FreeBSD : DNSdist -- vulnerabilities (431c2753-3503-11f1-bc6d-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	high
304468	Linux Distros Unpatched Vulnerability : CVE-2026-24030	Nessus	Misc.	high

Detections

Analytics

CVE-2026-24030

high

Tenable Plugins

high

high

high

high

high