dnsdist CVE-2026-33594

Exploitation requires a dnsdist instance configured to route DNS queries to at least one DoH backend that becomes overloaded or slow to respond. The attacker must have network-layer access to the dnsdist service (typically UDP/53 or TCP/53, or HTTPS/DoH port if directly exposed). The vulnerability is triggered when query volume exceeds the DoH backend's processing capacity, causing response latency to grow. No authentication is required. The vulnerability does NOT manifest against dnsdist instances that use only traditional UDP/TCP backends or that employ strict per-query timeout and eviction policies on buffered queries. Non-default configurations with aggressive query rate-limiting or memory-bounded queue sizes may reduce exploitability.

The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects a network-accessible denial-of-service vulnerability with low attack complexity and no authentication required. The attack vector is unauthenticated and does not require user interaction, making it broadly exploitable. However, the Availability impact is rated Low rather than High, suggesting the vulnerability causes degradation rather than complete service unavailability. Real-world risk depends critically on deployment context: organizations running dnsdist with DoH backends under normal load may experience memory pressure only under sustained attack; those with already-overloaded backends face elevated risk. The tag 'Information Disclosure' conflicts with the CVSS descriptor (which shows only Availability impact) - this discrepancy requires clarification from the vendor. EPSS and KEV status are not provided, so exploitation likelihood and active abuse cannot be independently verified. The low-complexity network attack vector suggests this is realistically exploitable by any attacker with network access, but the condition (overloaded DoH backend) is situational rather than universal. This is a credible denial-of-service vector for targeted attacks against known dnsdist deployments but may not trigger on all configurations.

An attacker with network access to a dnsdist instance identifies that it routes queries to a DoH backend. The attacker floods dnsdist with a sustained stream of DNS queries (e.g., random domain lookups or NXDOMAIN queries), overwhelming the DoH backend. As the backend becomes saturated, dnsdist buffers the accumulated queries without releasing them, causing memory consumption to climb linearly with query volume. The attacker maintains this traffic for minutes to hours, eventually forcing memory exhaustion and degraded service for legitimate clients. If the DoH backend remains overloaded, memory is never released until the attacker's connection closes.