This vulnerability in PowerDNS DNSdist involves a heap-based buffer overflow triggered by a malformed UDP response from a rogue backend. The crafted response contains a query ID that is off by one compared to the maximum configured value, resulting in an out-of-bounds write. This can cause the DNSdist service to crash or become unavailable, constituting a denial of service. The affected versions are 1.9.0 and 2.0.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

Successful exploitation of this vulnerability results in a denial of service due to an out-of-bounds write caused by a heap-based buffer overflow. There is no indication of confidentiality or significant integrity impact. The service may crash or become unresponsive, affecting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or validating backend UDP responses to prevent rogue or malformed packets from reaching DNSdist. Monitor vendor communications for updates on patches or official mitigations.