p PatchFirst

CVE-2026-0396

CVE-2026-0396 · HTML injection in the web dashboard

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

CVSS 3.1 · Low · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dnsdist

    Versions
    • ≥ 1.9.0, < 1.9.12: Affected (semver)
    • ≥ 2.0.0, < 2.0.3: Affected (semver)

    Update to 1.9.12; Update to 2.0.3

  • dnsdist Debian:12

    Versions
    • 1.7.3-2
    • 1.8.0-1
    • 1.8.1-1
    • 1.8.2-1
    • 1.8.2-2
    • 1.8.2-3
    • 1.8.3-1
    • 1.8.3-2
    • 1.8.3-3
    • 1.9.10-1
    • 1.9.3-1
    • 1.9.4-1
    • 1.9.5-1
    • 1.9.6-1
    • 1.9.8-1
    • 1.9.9-1
    • 2.0.0-1
    • 2.0.0-2
    • 2.0.0-3
    • 2.0.0-4
    • 2.0.0-5
    • 2.0.0-6
    • 2.0.0~rc1-1
    • 2.0.0~rc1-2
    • 2.0.0~rc2-1
    • 2.0.1-1
    • 2.0.2-1
    • 2.0.3-1
    • 2.0.4-1
    • 2.0.5-1
    • 2.0.5-2
    • 2.0.5-3
    • 2.0.6-1
    • 2.1.0-1
    • 2.1.0-2
    • 2.1.1-1
    • 2.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Debian:13

    Versions
    • 1.9.10-1
    • 1.9.10-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 1.9.14-0+deb13u1

    Update to 1.9.14-0+deb13u1

  • dnsdist Debian:14

    Versions
    • 1.9.10-1
    • 2.0.0-1
    • 2.0.0-2
    • 2.0.0-3
    • 2.0.0-4
    • 2.0.0-5
    • 2.0.0-6
    • 2.0.0~rc1-1
    • 2.0.0~rc1-2
    • 2.0.0~rc2-1
    • 2.0.1-1
    • 2.0.2-1
    Affected ranges
    • ECOSYSTEM: < 2.0.3-1

    Update to 2.0.3-1

  • dnsdist Ubuntu:16.04:LTS

    Versions
    • 1.0.0~alpha2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:18.04:LTS

    Versions
    • 1.2.0-1
    • 1.2.0-3
    • 1.2.1-1
    • 1.2.1-1build1
    • 1.2.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:20.04:LTS

    Versions
    • 1.4.0~rc3-1
    • 1.4.0-1
    • 1.4.0-1build1
    • 1.4.0-1build2
    • 1.4.0-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:22.04:LTS

    Versions
    • 1.5.1-3build2
    • 1.6.1-1build1
    • 1.6.1-1ubuntu0.1~esm1
    • 1.6.1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:24.04:LTS

    Versions
    • 1.8.0-1
    • 1.8.2-1
    • 1.8.2-2
    • 1.8.2-3
    • 1.8.3-1
    • 1.8.3-2
    • 1.8.3-2build1
    • 1.8.3-2build2
    • 1.8.3-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:25.10

    Versions
    • 1.9.8-1
    • 1.9.10-1
    • 1.9.10-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:26.10

    Versions
    • 2.0.2-1build1
    • 2.0.5-2ubuntu1
    • 2.0.5-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:26.04:LTS

    Versions
    • 1.9.10-1
    • 2.0.1-1
    • 2.0.2-1
    • 2.0.2-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →