This vulnerability in PowerDNS DNSdist arises from an out-of-bounds read condition caused by a crafted cached response when specific Lua API functions (getDomainListByAddress() or getAddressListByDomain()) are invoked on a packet cache. It affects versions 1.9.0 and 2.0.0. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction. The impact is limited to partial confidentiality loss and low availability impact, with no integrity compromise. No vendor advisory or patch information is currently provided.

An attacker can cause an out-of-bounds read in DNSdist by supplying a crafted cached response and invoking certain Lua functions on the packet cache. This may lead to partial information disclosure (confidentiality impact) and a low level of service disruption (availability impact). There is no indication of integrity compromise or privilege escalation. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using custom Lua code that calls getDomainListByAddress() or getAddressListByDomain() on packet caches with untrusted data. Monitor vendor channels for updates and apply patches once released.