Dnsdist CVE-2026-24030

CVSS 5.3 with network-based unauthenticated attack vector and low attack complexity indicates a readily exploitable denial-of-service condition. The EPSS exploitation probability is not provided, but CVSS assessment reflects low impact severity (only availability affected, no confidentiality or integrity compromise). However, real-world risk is elevated because (1) denial of service on a DNS load balancer directly impacts service availability for all downstream clients, (2) the attack is trivial to execute (no special privileges or user interaction required), (3) memory exhaustion can be triggered remotely without authentication, and (4) the outcome varies unpredictably-from controlled exception handling to process termination-making mitigation planning difficult. The absence of CISA KEV status and POC confirmation at analysis time suggests limited public exploitation, but the attack surface (all DNS over QUIC/HTTP/3 traffic) and ease of exploitation indicate this is a real priority for operators of DNSdist instances exposed to untrusted networks.

An attacker on the internet sends specially crafted DNS over QUIC or DNS over HTTP/3 packets to a publicly exposed DNSdist instance. The crafted payloads trigger excessive memory allocation during packet processing. In most cases, DNSdist detects an error and terminates the QUIC connection, but repeated attempts can exhaust available system memory. In constrained environments (virtual machines, containers with memory limits), a single or small number of requests can exhaust memory and crash the entire DNSdist process, rendering DNS resolution unavailable for all downstream clients relying on that load balancer.