The described flaw is an off‑by‑one error in DNSdist’s handling of UDP responses. When a rogue backend sends a response whose query ID is off by one relative to the maximum allowed value, DNSdist writes past the bounds of its internal buffer. This out‑of‑bounds write corrupts memory and causes the daemon to crash, resulting in a denial of service. The weakness is a classic buffer overflow (CWE‑122). The likely attack vector is a crafted response sent from a malicious backend to an unprotected DNSdist instance.

DNSdist, the caching DNS load‑balancing infrastructure from PowerDNS, is the impacted product. The advisory does not publish specific vulnerable versions, so administrators should verify that their installations are at or above the latest publicly available release. No other vendors are listed.

The CVSS score of 6.5 marks this issue as medium severity, and because the exploit requires only a malicious backend that can inject crafted UDP responses, the attack is feasible from a remote perspective. EPSS information is not available, and the vulnerability has not been listed in the CISA KEV catalog, indicating no known active exploitation. Nevertheless, the out‑of‑bounds write can lead to service interruption, which can be critical in high‑availability environments. Based on the description, it can be exploited remotely by a rogue backend.