Naoki Wakamatsu

**Name of the Vulnerable Software and Affected Versions** Versions prior to 2026 (affected versions not specified) **Description** An attacker could potentially trigger an out-of-bounds read by sending a specially crafted DNS response packet. This occurs when custom Lua code utilizes the `newDNSPacketOverlay` function to parse DNS packets. A successful exploit may lead to a denial of service due to a crash, or potentially allow access to unrelated memory, resulting in information disclosure. The `newDNSPacketOverlay` function is involved in the parsing process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DNSdist (affected versions not specified) **Description** An attacker may be able to trigger a use-after-free condition by sending specially crafted DNS queries to DNSdist when using custom Lua code. This occurs through the `DNSQuestion:getEDNSOptions` method. Specifically, `DNSQuestion:getEDNSOptions` might reference a modified version of the DNS packet, leading to a use-after-free and potentially causing a denial of service due to a crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libsoup (affected versions not specified) **Description** A stack-based buffer overflow vulnerability exists in libsoup during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, potentially leading to memory corruption and arbitrary code execution. The issue does not require authentication or user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.