SUSE-SU-2026:23123-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202623123-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23123-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:23123-1
- Upstream
- Related
- Published
- 2026-08-05T09:14:01Z
- Modified
- 2026-08-14T18:23:39Z
- Summary
- Security update for dnsdist
- Details
-
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-202623123-1/
- https://bugzilla.suse.com/1269201
- https://bugzilla.suse.com/1269202
- https://bugzilla.suse.com/1269203
- https://bugzilla.suse.com/1269204
- https://bugzilla.suse.com/1269205
- https://bugzilla.suse.com/1269206
- https://bugzilla.suse.com/1269207
- https://www.suse.com/security/cve/CVE-2026-40011
- https://www.suse.com/security/cve/CVE-2026-40208
- https://www.suse.com/security/cve/CVE-2026-40209
- https://www.suse.com/security/cve/CVE-2026-40210
- https://www.suse.com/security/cve/CVE-2026-40211
- https://www.suse.com/security/cve/CVE-2026-42004
- https://www.suse.com/security/cve/CVE-2026-42005
Affected packages
SUSE:Linux Enterprise Server 16.0 / dnsdist
Package
- Name
- dnsdist
- Purl
- pkg:rpm/suse/dnsdist&distro=SUSE%20Linux%20Enterprise%20Server%2016.0