From nobody Fri Apr 03 08:57:32 2026 X-Original-To: ports-bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fnCKT2gzSz6Y35y for ; Fri, 03 Apr 2026 08:57:33 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fnCKT27MNz3t9Z for ; Fri, 03 Apr 2026 08:57:33 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1775206653; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=U85FgdiqUTWcfrKyisBAMpHx9pWsp0HOkLUFDZLj1qY=; b=nmzAatKfQEIx9dWWLvsBnQ2ETWSpSPYbsmhYOZODYCFtLSDSihAN+DL2gKVZC3JpxMD+/7 WrJ/L4e2XOoxeUoWsG978sjGKcp36Yd12YjHXbBzCrPYtrQJaJB13Z4oh/OmcOqaFVdk1B P0CQ/IwSIUCNvDPrIOnhJHChqSf/IScszxFUz11bJaxpxBcC4Mx2t5X9JlTohpNhum17fx arEalCDbXtPHoinQXPvGyEYLhI6o0GaB7WL8gCl0MK8iH+LmIv2IaVj3tRytB+eNe9jTwB XGgblrdnuJy4WCA/OO+CTk+S9xGy9xrVUWZZmSfw0H2zhT5LuYsj9OWHyDySlA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1775206653; a=rsa-sha256; cv=none; b=dJT3sOsPciFFEMV9CDJlY8yGqymH0pid1rKpb8HqUzDQ+9YESJHgiPsekxRlBm+n1Xb2Pf wA6ZNBxDuIGnpI1TqvFNVY+Q3jidblBC3kxBnA8dNFdTrKGSAVN1rim+wI1KXkPYcV5V7A yTE0C8mud2kMiJ3KdqKlcrurcpgk3PKPtX2gmTULbbOY+hxMJW8X7JZAPyTz7sz2vx9K9s ZA8cM4CBESiJzwp1UIEoNcXUjxQdlk+sUumCYZVxvrZhEqePH1SeJXn/Q34XLLwSqwGroX v/S3x7xZ43xZc9+yTtP0xpZhBVhzeGXFzWopYcEg4bnJyPuvvdzBuV921hdQzg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1775206653; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=U85FgdiqUTWcfrKyisBAMpHx9pWsp0HOkLUFDZLj1qY=; b=F6L4E9BXdK2/N3aXpDe70J2Z0PHArHSqJ+dOGnOwHfpLcW/JrBPxW55cBiGT4xUnNPNgJ9 EgnA9DDeVZETVnXgvocxqm27sqorKPSV42naYYZCGNAtMwSyx75N/5s+FtdOxCLHnG4sha NGzuRuZp7XrvqryWuk8pGd8N6aisabOMShsN4tH1V34Ms/lXMNuKGuP5ds/gQdpMoQRI9N gQ2Gx2gBVSRrpuspMOZMdTgY94gIICr4gTLIm9gtB0Y3WzT+q5lU7mEVUFFsLJnCGsG6cb bVIjxifRftOGZGBVFZNP9fL72Rob/obSc79fN9adJL0MmjehgbJx1fxrOY9v6Q== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4fnCKT11w2zj39 for ; Fri, 03 Apr 2026 08:57:33 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 6338vXJm081017 for ; Fri, 3 Apr 2026 08:57:33 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 6338vXV2081016 for ports-bugs@FreeBSD.org; Fri, 3 Apr 2026 08:57:33 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 294225] dns/dnsdist upgrade to 2.0.3 fix CVE-2026-0396, CVE-2026-0397, CVE-2026-24028, CVE-2026-24029, CVE-2026-24030, CVE-2026-27853, CVE-2026-27854 Date: Fri, 03 Apr 2026 08:57:32 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: jordan@ostreff.info X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: ports-bugs@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback? X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter cc flagtypes.name attachments.created Message-ID: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Ports bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-ports-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-ports-bugs@freebsd.org Sender: owner-freebsd-ports-bugs@FreeBSD.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D294225 Bug ID: 294225 Summary: dns/dnsdist upgrade to 2.0.3 fix CVE-2026-0396, CVE-2026-0397, CVE-2026-24028, CVE-2026-24029, CVE-2026-24030, CVE-2026-27853, CVE-2026-27854 Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: Individual Port(s) Assignee: ports-bugs@FreeBSD.org Reporter: jordan@ostreff.info CC: tremere@cainites.net Flags: maintainer-feedback?(tremere@cainites.net) CC: tremere@cainites.net Created attachment 269334 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D269334&action= =3Dedit upgrade to 2.0.3 Here is my proposal of the update. Rust/Cargo components updated to latest versions supported by dnsdist.=20 Tested on adm64 stable/15 freebsd. The issues fixed in these releases are: CVE-2026-0396: An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either "DynBlockRulesGroup:setSuffixMatchRule" or "DynBlockRulesGroup:setSuffixMatchRuleFFI" CVE-2026-0397: When the internal webserver is enabled (default is disabled)= , an attacker might be able to trick an administrator logged to the dashboard in= to visiting a malicious website and extract information about the running configuration from the dashboard CVE-2026-24028: An attacker might be able to trigger an out-of-bounds read = by sending a crafted DNS response packet, when custom Lua code uses "newDNSPacketOverlay" to parse DNS packets CVE-2026-24029: When the "early_acl_drop" ("earlyACLDrop" in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the "nghtt= p2" provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL CVE-2026-24030: An attacker might be able to trick DNSdist into allocating = too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in denial of service CVE-2026-27853: An attacker might be able to trigger an out-of-bounds write= by sending crafted DNS responses to a DNSdist using the "DNSQuestion:changeNam= e" or "DNSResponse:changeName" methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exc= eed 65535 bytes, potentially leading to a crash resulting in denial of service CVE-2026-27854: Denial of service when using DNSQuestion:getEDNSOptions met= hod in custom Lua code --=20 You are receiving this mail because: You are the assignee for the bug.=