CVE-2026-42004: DNSdist EDNS OPT Record Filtering Bypass

Technical summary

The vulnerability stems from a logic gap in DNSdist's EDNS option handling during the filtering pipeline. When DNSdist processes DNS queries, it evaluates EDNS OPT records against configured filtering rules to prevent certain options from reaching backend resolvers. However, if EDNS Client Subnet (ECS) insertion is enabled, DNSdist reconstructs the OPT record after filtering. A crafted OPT record that is deemed invalid or ignored during the initial filter stage can be rewritten as legitimate when ECS is inserted, allowing the original option content to reach the backend despite filtering intent. This is a case of improper input validation and insufficient state management across processing phases (CWE-115: Misinterpretation of Input). The CVSS 3.1 score of 3.7 (Low severity) reflects the need for difficult conditions (AC:H) and limited impact scope.

Business impact

For organizations running DNSdist as a security or compliance control point, this vulnerability reduces the effectiveness of query filtering policies. If DNSdist is configured to block certain EDNS options for security, privacy, or regulatory reasons, attackers can circumvent those controls when ECS insertion is active. This may expose backend DNS servers to options the organization intended to filter, potentially leaking information or enabling reconnaissance. The impact is most significant for organizations that rely on DNSdist's filtering as a boundary control between untrusted networks and backend resolvers. Organizations not using ECS insertion or not filtering EDNS options are not at risk.

Affected systems

The vulnerability affects DNSdist installations where both (1) EDNS filtering rules are configured to block specific options and (2) EDNS Client Subnet insertion is enabled. The specific affected versions of DNSdist are not provided in the available disclosure data; verify the DNSdist security advisory and release notes for patched versions and the exact range of vulnerable releases. Deployments that do not use ECS insertion, or that do not enforce EDNS filtering policies, are unaffected.

Exploitability

Exploitation requires network-level access to send crafted DNS queries to DNSdist (requiring AV:N—any network). However, the CVSS vector AC:H indicates difficult or restrictive conditions are necessary to trigger the vulnerability, likely meaning the attacker must craft a specific combination of OPT record structure and ECS configuration state. No public exploit code or active exploitation has been confirmed (this is not in the CISA KEV catalog). The barrier to weaponization is moderate; a determined attacker with knowledge of DNSdist internals could craft payloads, but this is not a trivial remote code execution or widespread attack surface.

Remediation

Update DNSdist to a patched version that fixes the EDNS OPT record rewriting logic. Check the DNSdist project security advisories and GitHub releases for the specific version that addresses this bypass. Additionally, review your filtering rules and ECS configuration: if ECS insertion is not operationally necessary, disabling it removes the attack vector entirely. If ECS is required, ensure you understand which EDNS options are being filtered and confirm the patch is applied before relying on those filters for security controls.

Patch guidance

Visit the official DNSdist project repository and security advisories to identify the patched version. The vulnerable behavior is tied to EDNS OPT record handling during ECS insertion, so look for patches explicitly mentioning EDNS filtering, OPT record rewriting, or ECS handling. Apply patches during your normal change management window; given the Low severity and high barrier to exploitation, this is not an emergency but should be scheduled within your standard patching cycle. Test the patch in a staging environment that mirrors your ECS and filtering configuration before production deployment.

Detection guidance

Monitor DNSdist query logs and backend DNS server logs for EDNS options that should have been filtered but appear in queries. If you have detailed query logging enabled, compare the OPT records DNSdist records as incoming versus what appears in backend queries—discrepancies indicate the vulnerability may have been exploited. Anomalous or unexpected EDNS options in backend queries, especially when ECS is enabled, warrant investigation. Network-based DNS monitoring tools can inspect EDNS options in live traffic to detect suspicious patterns, though this requires baseline knowledge of what options should legitimately appear.

Why prioritize this

This vulnerability warrants standard-priority patching but not emergency response. The CVSS score of 3.7 (Low) and high complexity barrier (AC:H) mean real-world exploitation is unlikely without adversary sophistication. However, if your organization relies on DNSdist filtering policies for compliance or security controls—particularly to block specific EDNS options—prioritize patching to restore confidence in those controls. Non-critical deployments or those without ECS insertion can defer patching to the next scheduled maintenance window. Organizations in regulated industries handling sensitive DNS queries should prioritize patching sooner.

Risk score, explained

The Low severity rating (3.7/10) reflects limited impact scope—only integrity (I:L) is affected, with no confidentiality or availability loss. The high complexity requirement (AC:H) substantially lowers the score, indicating the vulnerability is not trivially exploitable and requires specific network conditions or crafted payloads. The attack vector is network-based (AV:N), which raises concern, but the combination of barriers means the vulnerability is not a top-tier threat. It is not in CISA's Known Exploited Vulnerabilities catalog, indicating no widespread active exploitation. Prioritize this based on your reliance on DNSdist filtering controls, not on raw CVSS score.

Frequently asked questions