CVE-2026-0397: falha de baixa gravidade em PowerDNS DNSdist
Information disclosure via CORS misconfiguration
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.1epss 0.2%
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
PowerDNS · DNSdistCVEs relacionadas — PowerDNS DNSdist
No mesmo produto, das mais perigosas para as menos.
CVE-2025-30194HIGHDenial of service via crafted DoH exchangeEPSS 2.3%CVE-2024-25581HIGHTransfer requests received over DoH can lead to a denial of service in DNSdistEPSS 1.1%CVE-2026-33598MEDIUMOut-of-bounds read in cache inspection via LuaEPSS 1.1%CVE-2026-24028MEDIUMOut-of-bounds read when parsing DNS packets via LuaEPSS 1.1%CVE-2026-40210MEDIUMOut-of-bounds read in SetMacAddrActionEPSS 0.7%CVE-2026-33602MEDIUMOff-by-one access when processing crafted UDP responsesEPSS 0.7%