SUSE-SU-2026:22319-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202622319-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22319-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:22319-1
- Upstream
- Related
- Published
- 2026-06-22T14:28:56Z
- Modified
- 2026-07-02T18:24:10Z
- Summary
- Security update for dnsdist
- Details
-
This update for dnsdist fixes the following issues
- CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
- CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
- CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
- CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
- CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
- CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
- CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
- CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
- CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
- CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
- CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
- CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
- CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
- CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
- CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
- CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
- CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
- CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).
Changes for dnsdist:
- Updated to 1.9.13
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-202622319-1/
- https://bugzilla.suse.com/1261236
- https://bugzilla.suse.com/1261237
- https://bugzilla.suse.com/1261238
- https://bugzilla.suse.com/1261239
- https://bugzilla.suse.com/1261240
- https://bugzilla.suse.com/1261241
- https://bugzilla.suse.com/1261243
- https://bugzilla.suse.com/1262536
- https://bugzilla.suse.com/1262537
- https://bugzilla.suse.com/1262538
- https://bugzilla.suse.com/1262539
- https://bugzilla.suse.com/1262540
- https://bugzilla.suse.com/1262541
- https://bugzilla.suse.com/1262542
- https://bugzilla.suse.com/1262543
- https://bugzilla.suse.com/1262544
- https://bugzilla.suse.com/1262545
- https://bugzilla.suse.com/1262546
- https://www.suse.com/security/cve/CVE-2026-0396
- https://www.suse.com/security/cve/CVE-2026-0397
- https://www.suse.com/security/cve/CVE-2026-24028
- https://www.suse.com/security/cve/CVE-2026-24029
- https://www.suse.com/security/cve/CVE-2026-24030
- https://www.suse.com/security/cve/CVE-2026-27853
- https://www.suse.com/security/cve/CVE-2026-27854
- https://www.suse.com/security/cve/CVE-2026-33254
- https://www.suse.com/security/cve/CVE-2026-33257
- https://www.suse.com/security/cve/CVE-2026-33260
- https://www.suse.com/security/cve/CVE-2026-33593
- https://www.suse.com/security/cve/CVE-2026-33594
- https://www.suse.com/security/cve/CVE-2026-33595
- https://www.suse.com/security/cve/CVE-2026-33596
- https://www.suse.com/security/cve/CVE-2026-33597
- https://www.suse.com/security/cve/CVE-2026-33598
- https://www.suse.com/security/cve/CVE-2026-33599
- https://www.suse.com/security/cve/CVE-2026-33602
Affected packages
SUSE:Linux Enterprise Server 16.0 / dnsdist
Package
- Name
- dnsdist
- Purl
- pkg:rpm/suse/dnsdist&distro=SUSE%20Linux%20Enterprise%20Server%2016.0