The flaw allows an attacker to send a crafted EDNS OPT record that DNSdist initially ignores during its filtering process. When DNSdist appends an EDNS Client Subnet option to the query, the previously ignored OPT record is rewritten into a valid form and forwarded to the backend. This mechanism enables malicious or unintended EDNS options to reach the backend DNS server, potentially exposing sensitive configuration data or facilitating lateral movement and other indirect attacks.

Any installation of PowerDNS DNSdist is affected; no specific product version was identified in the advisory, so the vulnerability applies broadly to all variants of DNSdist as delivered by PowerDNS.

The CVSS score of 3.7 reflects a low overall severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to craft and send a DNS query to a DNSdist instance, with no authentication or privileged operation needed. The primary risk is the exposure of EDNS options that DNSdist would otherwise discard, potentially leaking information or enabling further exploitation via the backend’s interpretation of those options.