Skip to main content

dnsdist CVE-2026-33594

| EUVDEUVD-2026-24931 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-04-22 security@open-xchange.com
Denial Of Service Suse Dnsdist Powerdns
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

6
Patch released
Apr 24, 2026 - 16:48 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
Analysis Generated
Apr 22, 2026 - 15:02 vuln.today
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24931
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
MEDIUM 5.3

DescriptionCVE.org

A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.

AnalysisAI

dnsdist can be forced into excessive memory allocation when a client generates high volumes of DNS queries routed to an overloaded DNS-over-HTTPS (DoH) backend, causing queries to accumulate in an unbounded buffer that persists until connection closure. This denial-of-service condition affects dnsdist deployments with DoH backends under load, allowing unauthenticated remote attackers to exhaust server memory with sustained query traffic.

Technical ContextAI

dnsdist is a DNS load balancer and distributor that forwards DNS queries to backend resolvers, including DNS-over-HTTPS (DoH) endpoints. The vulnerability resides in the DoH backend routing logic, where incoming client queries are buffered while awaiting responses from the overloaded DoH server. The root cause is improper memory management: when the DoH backend becomes saturated, query buffers are not released incrementally but instead accumulate until the client connection terminates. This violates the principle of bounded resource allocation in network services. The issue is exacerbated when clients maintain persistent connections and repeat queries; each query adds to an unbounded accumulator rather than being discarded or rate-limited. CWE classification is not provided by the vendor, but this pattern aligns with CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling).

RemediationAI

Apply the patched version of dnsdist released by PowerDNS in response to advisory 2026-04, available at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html. The patch implements bounded buffer allocation and query discarding for overloaded DoH backends. Until patching is feasible, implement rate-limiting on inbound DNS queries using dnsdist's query rate-limiting rules to cap queries from individual clients or subnets, reducing buffer accumulation. Additionally, configure backend health checks and failover to alternative DoH servers to prevent sustained overload conditions. Monitor memory usage on dnsdist instances with DoH backends and set alerts to trigger on sustained memory growth above baseline; consider implementing memory limits via operating system controls (cgroups, ulimit) as a fail-safe. These mitigations reduce attack impact but do not eliminate the root cause and should be treated as temporary measures pending patch deployment.

More in Dnsdist

View all
CVE-2017-7557 HIGH
8.8 Aug 22

dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
CVE-2026-24028 HIGH
8.2 Mar 31

Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
CVE-2026-33593 HIGH
7.5 Apr 22

Remote denial of service in dnsdist allows unauthenticated attackers to crash the DNS load balancer by sending specially
CVE-2026-27853 HIGH
7.5 Mar 31

DNSdist fails to validate packet size bounds when rewriting DNS questions or responses via Lua methods (DNSQuestion:chan
CVE-2026-24030 HIGH
7.5 Mar 31

Memory exhaustion in DNSdist allows remote, unauthenticated attackers to trigger denial of service by crafting malicious
CVE-2026-27854 HIGH
7.5 Mar 31

DNSdist instances using custom Lua code can be crashed via denial of service when the DNSQuestion:getEDNSOptions method

CVE-2026-33602 MEDIUM
6.5 Apr 22

DNSdist is vulnerable to denial of service via out-of-bounds write when processing crafted UDP responses from a rogue ba
CVE-2026-24029 MEDIUM
6.5 Mar 31

PowerDNS dnsdist allows unauthenticated DNS over HTTPS (DoH) queries to bypass access control lists when the early_acl_d
CVE-2018-14663 MEDIUM
5.9 Nov 26

An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing d
CVE-2026-33260 MEDIUM
5.3 Apr 22

Denial of service in PowerDNS Authoritative, Recursor, and dnsdist via unbounded memory allocation in their internal web
CVE-2026-33257 MEDIUM
5.3 Apr 22

Unlimited memory allocation in PowerDNS internal web server allows remote denial of service via crafted web requests. Th
CVE-2026-33595 MEDIUM
5.3 Apr 22

dnsdist allows remote denial-of-service attacks through memory exhaustion by generating numerous error responses on sing

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-33594 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy