A rogue DNS backend can send a specially crafted SVCB record to DNSdist when the autoUpgrade option in Lua or the auto_upgrade setting in YAML is enabled. The malformed response triggers an out‑of‑bounds read in the service discovery code, potentially allowing an attacker to read unintended memory contents from the DNSdist process. This is a modest confidentiality risk and may cause a crash if exploited, but does not provide direct code execution or privilege escalation.

The vulnerability affects the PowerDNS DNSdist service. No specific product or software version is listed in the advisory, and the feature is disabled by default. Any deployment that has enabled autoUpgrade or auto_upgrade is susceptible.

The CVSS score of 3.1 classifies this as low severity. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, indicating a limited likelihood of real‑world exploitation. The attack vector is likely a remote backend with network ability to send DNS responses; however, the vulnerable code is only exercised when the DDR feature is active, which remains turned off in default configurations. No public exploit exists; the risk is primarily informational unless the configuration is mis‑controlled.