CVE-2026-40211 Details
Description
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
A denial-of-service vulnerability has been identified in PowerDNS DNSdist versions through 2.0.6 and 1.9.14. The issue arises when an attacker sends crafted DNS over HTTP/3 queries, causing an exception that delays the release of certain buffers. While these buffers are eventually freed at the end of the QUIC connection, it may be possible in some configurations to open enough concurrent DoH3 streams to create an out-of-memory condition, leading to a denial-of-service situation.
Users can upgrade to PowerDNS DNSdist versions 1.9.15 or 2.0.7, where this vulnerability has been patched. Alternatively, DoH3 can be disabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| PowerDNS dnsdist | <= 2.0.6 (semver) <= 1.9.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |