An attacker can induce an out‑of‑bounds memory write by sending crafted DNS responses that use the DNSQuestion:changeName or DNSResponse:changeName Lua methods. This causes the rewritten packet to grow beyond the original size and may exceed the 65535‑byte limit of a DNS message, potentially corrupting memory and crashing DNSdist. The crash results in a denial‑of‑service condition for the DNS service.

The vulnerability is present in PowerDNS DNSdist. Any installation that enables custom Lua scripts that call the changeName functions is potentially affected. The advisory lists the affected product as DNSdist; specific version numbers are not included, so any currently running version could be susceptible until patched.

The CVSS base score is 5.9, indicating a medium risk. No EPSS score is listed and the vulnerability is not in the KEV catalog, suggesting lower exploitation probability. The attack vector is feasible from an external source capable of delivering crafted DNS responses, as the out‑of‑bounds write occurs during packet rewriting. Without a publicly available exploit, the risk remains tempered, yet the crash can disrupt network services making it a concern.