# OPENSUSE-SU-2026:21015-1: dnsdist security update

OPENSUSE-SU-2026:21015-1, released June 22, 2026, fixes 18 CVEs in dnsdist (version 1.9.13-160000.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/opensuse-su-2026-21015-1
- Platform: Linux
- Released: Jun 22, 2026
- Priority: Urgent (Closes CVE-2026-33598, rated Critical)
- CVEs: 18, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2026:21015-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [dnsdist](https://patchblox.com/security/data/product/linux/dnsdist.md) | opensuse-leap 16.0 | 1.9.13-160000.1.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-33598](https://patchblox.com/security/data/cve/CVE-2026-33598.md) | Urgent | dnsdist: Out-of-bounds read in cache inspection via Lua (bsc#1262541). | 9.1 | 0.0107 |  |
| [CVE-2026-24028](https://patchblox.com/security/data/cve/CVE-2026-24028.md) | High | dnsdist: crafted DNS packet parsed by Lua code using `newDNSPacketOverlay` can lead to an out-of-bounds read | 8.2 | 0.0107 |  |
| [CVE-2026-33602](https://patchblox.com/security/data/cve/CVE-2026-33602.md) | High | dnsdist: Off-by-one access when processing crafted UDP responses (bsc#1262539). | 8.2 | 0.0073 |  |
| [CVE-2026-24030](https://patchblox.com/security/data/cve/CVE-2026-24030.md) | High | dnsdist: crafted DoQ and DoH3 queries can lead to unbounded memory allocation and DoS (bsc#1261240). | 7.5 | 0.0056 |  |
| [CVE-2026-33260](https://patchblox.com/security/data/cve/CVE-2026-33260.md) | High | dnsdist: Insufficient input validation of internal webserver (bsc#1262537). | 7.5 | 0.0052 |  |
| [CVE-2026-33257](https://patchblox.com/security/data/cve/CVE-2026-33257.md) | High | dnsdist: Insufficient input validation of internal webserver (bsc#1262536). | 7.5 | 0.0051 |  |
| [CVE-2026-27853](https://patchblox.com/security/data/cve/CVE-2026-27853.md) | High | dnsdist: crafted DNS responses sent to a DNSdist using certain methods in custom Lua code (`changeName`) can | 7.5 | 0.0051 |  |
| [CVE-2026-27854](https://patchblox.com/security/data/cve/CVE-2026-27854.md) | High | dnsdist: crafted DNS queries sent to a DNSdist using the `DNSQuestion:getEDNSOptions` method in custom Lua | 7.5 | 0.0049 |  |
| [CVE-2026-33593](https://patchblox.com/security/data/cve/CVE-2026-33593.md) | High | dnsdist: Denial of service via crafted DNSCrypt query (bsc#1262546). | 7.5 | 0.0038 |  |
| [CVE-2026-33254](https://patchblox.com/security/data/cve/CVE-2026-33254.md) | High | dnsdist: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538). | 7.5 | 0.0037 |  |
| [CVE-2026-33594](https://patchblox.com/security/data/cve/CVE-2026-33594.md) | High | dnsdist: Outgoing DoH excessive memory allocation (bsc#1262545). | 7.5 | 0.0037 |  |
| [CVE-2026-33595](https://patchblox.com/security/data/cve/CVE-2026-33595.md) | High | dnsdist: DoQ/DoH3 excessive memory allocation (bsc#1262544). | 7.5 | 0.0037 |  |
| [CVE-2026-33597](https://patchblox.com/security/data/cve/CVE-2026-33597.md) | High | dnsdist: PRSD detection denial of service (bsc#1262542). | 7.5 | 0.0035 |  |
| [CVE-2026-33599](https://patchblox.com/security/data/cve/CVE-2026-33599.md) | High | dnsdist: Out-of-bounds read in service discovery (bsc#1262540). | 8.1 | 0.0028 |  |
| [CVE-2026-33596](https://patchblox.com/security/data/cve/CVE-2026-33596.md) | Routine | dnsdist: TCP backend stream ID overflow (bsc#1262543). | 6.5 | 0.0017 |  |
| [CVE-2026-0397](https://patchblox.com/security/data/cve/CVE-2026-0397.md) | Routine | dnsdist: misconfiguration of the CORS policy can lead to information disclosure (bsc#1261237). | 4.3 | 0.0017 |  |
| [CVE-2026-24029](https://patchblox.com/security/data/cve/CVE-2026-24029.md) | Routine | dnsdist: disabled option on a DNS over HTTPS nghttp2 frontend allows clients to bypass ACLs and send DoH | 6.5 | 0.0015 |  |
| [CVE-2026-0396](https://patchblox.com/security/data/cve/CVE-2026-0396.md) | Routine | dnsdist: crafted DNS queries triggering domain-based dynamic rules can lead to HTML injection in the web | 4.3 | 0.0014 |  |

---

Data as of 2026-11-11T13:47:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.