---
title: PowerDNS DNSdist 1.9.12 and 2.0.3 Released (Security Release)
description: PowerDNS DNSdist 1.9.12 and 2.0.3 Released (Security Release).
---

[PowerDNS Blog ](https://blog.powerdns.com)

# [PowerDNS DNSdist 1.9.12 and 2.0.3 Released (Security Release)](https://blog.powerdns.com/2026/03/31/powerdns-dnsdist-1.9.12-and-2.0.3-released)

 Written by [Remi Gacogne](https://blog.powerdns.com/author/rgacogne) | Mar 31, 2026 10:04:07 AM

Today we released two new versions of DNSdist, 1.9.12 and 2.0.3, fixing several security issues that have been reported to us. These security issues are low-severity or involve unusual configurations.

The issues fixed in these releases are:

- CVE-2026-0396: An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either "DynBlockRulesGroup:setSuffixMatchRule" or "DynBlockRulesGroup:setSuffixMatchRuleFFI"
- CVE-2026-0397: When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard
- CVE-2026-24028: An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses "newDNSPacketOverlay" to parse DNS packets
- CVE-2026-24029: When the "early_acl_drop" ("earlyACLDrop" in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the "nghttp2" provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL
- CVE-2026-24030: An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in denial of service
- CVE-2026-27853: An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the "DNSQuestion:changeName" or "DNSResponse:changeName" methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exceed 65535 bytes, potentially leading to a crash resulting in denial of service
- CVE-2026-27854: Denial of service when using DNSQuestion:getEDNSOptions method in custom Lua code

A few bugs have been fixed in addition to these security issues, please see the ChangeLogs ([1.9.12](https://www.dnsdist.org/changelog.html#change-1.9.12), [2.0.3](https://www.dnsdist.org/changelog.html#change-2.0.3)) for more details.

Please see the DNSdist [website](https://dnsdist.org/) for the current documentation.

Please send us all feedback and issues you might have via the [mailing list](https://mailman.powerdns.com/mailman/listinfo/dnsdist), or in case of a bug, via [GitHub](https://github.com/PowerDNS/pdns/issues/new/choose).

The release tarballs ([1.9.12](https://downloads.powerdns.com/releases/dnsdist-1.9.12.tar.bz2), [2.0.3](https://downloads.powerdns.com/releases/dnsdist-2.0.3.tar.xz)) and their signatures ([1.9.12](https://downloads.powerdns.com/releases/dnsdist-1.9.12.tar.bz2.sig), [2.0.3](https://downloads.powerdns.com/releases/dnsdist-2.0.3.tar.xz.sig)) are available on the downloads website, and packages for several distributions are available from our [repository](https://repo.powerdns.com/).

[View full post](https://blog.powerdns.com/2026/03/31/powerdns-dnsdist-1.9.12-and-2.0.3-released)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Remi Gacogne"
  },
  "dateModified" : "2026-04-22T09:59:42.889Z",
  "datePublished" : "2026-03-31T10:04:07Z",
  "headline" : "PowerDNS DNSdist 1.9.12 and 2.0.3 Released (Security Release)",
  "image" : {
    "@type" : "ImageObject",
    "height" : 540,
    "url" : "https://20334960.fs1.hubspotusercontent-na1.net/hubfs/20334960/PowerDNS_dnsdist_release_blog.png",
    "width" : 1008
  },
  "mainEntityOfPage" : "https://blog.powerdns.com/2026/03/31/powerdns-dnsdist-1.9.12-and-2.0.3-released",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "PowerDNS Blog"
  }
}
```