Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2026-0396

HTML injection in the web dashboard

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OX

Description

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PowerDNS DNSdist

Default version status: unaffected

  • 1.9.0 to < 1.9.12affected
  • 2.0.0 to < 2.0.3affected

References