Linux · 
openSUSE Leap · Security advisory · June 22, 2026
openSUSE Leap · Security advisory · June 22, 2026OPENSUSE-SU-2026:21015-1: dnsdist security update
OPENSUSE-SU-2026:21015-1, released June 22, 2026, fixes 18 CVEs in dnsdist (version 1.9.13-160000.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
18
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0107
65th percentile
Priority of the 18 CVEs
Patch now 0
Urgent 1
High 13
Routine 4
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| dnsdist | opensuse-leap 16.0 | 1.9.13-160000.1.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-33598 | dnsdist: Out-of-bounds read in cache inspection via Lua (bsc#1262541). | 9.1 | 0.0107 | None reported |
| High | CVE-2026-24028 | dnsdist: crafted DNS packet parsed by Lua code using `newDNSPacketOverlay` can lead to an out-of-bounds read | 8.2 | 0.0107 | None reported |
| High | CVE-2026-33602 | dnsdist: Off-by-one access when processing crafted UDP responses (bsc#1262539). | 8.2 | 0.0073 | None reported |
| High | CVE-2026-24030 | dnsdist: crafted DoQ and DoH3 queries can lead to unbounded memory allocation and DoS (bsc#1261240). | 7.5 | 0.0056 | None reported |
| High | CVE-2026-33260 | dnsdist: Insufficient input validation of internal webserver (bsc#1262537). | 7.5 | 0.0052 | None reported |
| High | CVE-2026-33257 | dnsdist: Insufficient input validation of internal webserver (bsc#1262536). | 7.5 | 0.0051 | None reported |
| High | CVE-2026-27853 | dnsdist: crafted DNS responses sent to a DNSdist using certain methods in custom Lua code (`changeName`) can | 7.5 | 0.0051 | None reported |
| High | CVE-2026-27854 | dnsdist: crafted DNS queries sent to a DNSdist using the `DNSQuestion:getEDNSOptions` method in custom Lua | 7.5 | 0.0049 | None reported |
| High | CVE-2026-33593 | dnsdist: Denial of service via crafted DNSCrypt query (bsc#1262546). | 7.5 | 0.0038 | None reported |
| High | CVE-2026-33254 | dnsdist: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538). | 7.5 | 0.0037 | None reported |
| High | CVE-2026-33594 | dnsdist: Outgoing DoH excessive memory allocation (bsc#1262545). | 7.5 | 0.0037 | None reported |
| High | CVE-2026-33595 | dnsdist: DoQ/DoH3 excessive memory allocation (bsc#1262544). | 7.5 | 0.0037 | None reported |
| High | CVE-2026-33597 | dnsdist: PRSD detection denial of service (bsc#1262542). | 7.5 | 0.0035 | None reported |
| High | CVE-2026-33599 | dnsdist: Out-of-bounds read in service discovery (bsc#1262540). | 8.1 | 0.0028 | None reported |
| Routine | CVE-2026-33596 | dnsdist: TCP backend stream ID overflow (bsc#1262543). | 6.5 | 0.0017 | None reported |
| Routine | CVE-2026-0397 | dnsdist: misconfiguration of the CORS policy can lead to information disclosure (bsc#1261237). | 4.3 | 0.0017 | None reported |
| Routine | CVE-2026-24029 | dnsdist: disabled option on a DNS over HTTPS nghttp2 frontend allows clients to bypass ACLs and send DoH | 6.5 | 0.0015 | None reported |
| Routine | CVE-2026-0396 | dnsdist: crafted DNS queries triggering domain-based dynamic rules can lead to HTML injection in the web | 4.3 | 0.0014 | None reported |
Showing 1 to 18 of 18
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.