A use‑after‑free flaw exists in DNSdist’s DNSQuestion:getEDNSOptions method, which is invoked by custom Lua code to parse EDNS options from DNS queries. When an attacker sends specially crafted queries that cause DNSQuestion:getEDNSOptions to reference a packet that has already been freed, the process crashes. The result is a denial of service to clients contacting the affected DNSdist instance; the crash does not expose sensitive information but interrupts DNS resolution for legitimate users.

PowerDNS DNSdist, the high‑performance recursive DNS server that supports custom Lua scripts, is impacted. The vulnerability applies to any DNSdist release in which DNSQuestion:getEDNSOptions has not been patched to guard against use‑after‑free. Specific version numbers are not listed, so all installations that rely on the unpatched Lua routine are considered vulnerable.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of active exploitation. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog, further implying limited real‑world impact. Attackers can trigger the flaw remotely by sending crafted DNS queries over the network to a DNSdist instance that processes EDNS options via Lua, without requiring authentication or elevated privileges. Successful exploitation results in the DNSdist process termination, leading to a brief disruption of DNS services.