DNSdist CVE-2026-33254

The vulnerability requires that DoQ (DNS over QUIC) or DoH3 (DNS over HTTPS/3) be explicitly enabled in the DNSdist configuration. By default, these protocols are disabled and must be activated by an administrator via configuration directives (e.g., 'addDOQLocal' or 'addDOH3Local'). No special DNS query content or authentication is required - the attacker needs only network-layer reachability to the DoQ/DoH3 listener port (typically UDP 443 for DoQ, TCP 443 for DoH3) and the ability to initiate many concurrent connections. Standard unpatched DNSdist with non-default configuration (DoQ/DoH3 enabled) is vulnerable; default installations are unaffected.

CVSS 5.3 with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L indicates a network-accessible denial of service with low attack complexity and no authentication barrier, but impact is limited to availability (A:L, not A:H). EPSS data not provided, limiting real-world exploitation probability assessment. KEV status unknown - no confirmation of active exploitation or proof-of-concept. The built-in default-disabled status of DoQ/DoH3 significantly reduces real-world risk: only administrators who explicitly enable these protocols are exposed. Attack complexity is low (AC:L), suggesting no special conditions or race conditions required, but the attacker must know these protocols are enabled on the target. Realistic risk is moderate for deployed instances with DoQ/DoH3 active (A:L impact is service disruption, not data loss), but low for the general DNSdist user base given the opt-in nature. Compare: high-CVSS network RCE vs. medium-CVSS DoS on non-default feature.

An attacker identifies a publicly facing DNSdist instance with DoQ or DoH3 enabled (e.g., via service scanning or from network reconnaissance). The attacker then programmatically opens thousands of concurrent QUIC or HTTP/3 connections to the DoQ/DoH3 listener port without completing DNS queries or sending any data after connection establishment. Each connection allocates memory in DNSdist that is not freed, exhausting available RAM until the process crashes or the system becomes unresponsive, disrupting legitimate DNS service.