A crafted cached response can trigger an out-of-bounds read when custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a DNSdist packet cache. The vulnerability allows an attacker to read memory beyond the intended bounds, potentially exposing sensitive data or causing a service crash, thereby affecting confidentiality, integrity, and availability. This weakness is classified as CWE‑125.

The issue affects PowerDNS DNSdist. No specific version range is listed in the advisory, so all installations that run Lua scripts capable of invoking the affected API should be reviewed.

The CVSS score of 4.8 indicates a moderate risk level. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector requires an attacker to inject or influence Lua code running within DNSdist, which could be achieved through configuration changes or compromised scripts. Consequently, the practical exploitation likelihood remains moderate and contingent on the presence of exploitable Lua scripts.