Lookup for vulnerable packages by Package URL.
| Purl | pkg:deb/debian/dnsdist@2.0.4-1 |
| Type | deb |
| Namespace | debian |
| Name | dnsdist |
| Version | 2.0.4-1 |
| Qualifiers |
|
| Subpath | |
| Is_vulnerable | false |
| Next_non_vulnerable_version | null |
| Latest_non_vulnerable_version | null |
| Affected_by_vulnerabilities |
|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-1mgq-74b9-4bcg |
| vulnerability_id |
VCID-1mgq-74b9-4bcg |
| summary |
A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33595
|
| risk_score |
1.3 |
| exploitability |
0.5 |
| weighted_severity |
2.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1mgq-74b9-4bcg |
|
| 1 |
| url |
VCID-744k-b7s7-kbh5 |
| vulnerability_id |
VCID-744k-b7s7-kbh5 |
| summary |
A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33599
|
| risk_score |
0.8 |
| exploitability |
0.5 |
| weighted_severity |
1.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-744k-b7s7-kbh5 |
|
| 2 |
| url |
VCID-7xds-447f-qufr |
| vulnerability_id |
VCID-7xds-447f-qufr |
| summary |
A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33596
|
| risk_score |
0.8 |
| exploitability |
0.5 |
| weighted_severity |
1.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7xds-447f-qufr |
|
| 3 |
| url |
VCID-a65j-y7z3-fudk |
| vulnerability_id |
VCID-a65j-y7z3-fudk |
| summary |
A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33602
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-a65j-y7z3-fudk |
|
| 4 |
|
| 5 |
| url |
VCID-chzq-qej6-rkdq |
| vulnerability_id |
VCID-chzq-qej6-rkdq |
| summary |
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33257
|
| risk_score |
1.3 |
| exploitability |
0.5 |
| weighted_severity |
2.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-chzq-qej6-rkdq |
|
| 6 |
|
| 7 |
| url |
VCID-nrex-hpxg-ekhs |
| vulnerability_id |
VCID-nrex-hpxg-ekhs |
| summary |
A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33594
|
| risk_score |
1.3 |
| exploitability |
0.5 |
| weighted_severity |
2.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nrex-hpxg-ekhs |
|
| 8 |
| url |
VCID-pfhu-1qdf-p7d5 |
| vulnerability_id |
VCID-pfhu-1qdf-p7d5 |
| summary |
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33260
|
| risk_score |
1.3 |
| exploitability |
0.5 |
| weighted_severity |
2.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pfhu-1qdf-p7d5 |
|
| 9 |
|
| 10 |
| url |
VCID-ytdy-s1ug-dkh7 |
| vulnerability_id |
VCID-ytdy-s1ug-dkh7 |
| summary |
An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33254
|
| risk_score |
1.3 |
| exploitability |
0.5 |
| weighted_severity |
2.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ytdy-s1ug-dkh7 |
|
|
| Risk_score | null |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:deb/debian/dnsdist@2.0.4-1 |