EUVD-2026-24933
GHSA-6482-x4xv-9qvm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.
AnalysisAI
dnsdist allows remote denial-of-service attacks through memory exhaustion by generating numerous error responses on single DoQ (DNS-over-QUIC) and DoH3 (DNS-over-HTTPS/3) connections. An unauthenticated remote attacker can trigger excessive memory allocation by rapidly sending queries that produce error responses, with resources not properly released until connection termination. CVSS 5.3 (AV:N/AC:L/PR:N/UI:N) reflects network-accessible availability impact; no public exploit identified at time of analysis.
Technical ContextAI
dnsdist is a DNS load balancer and proxy that forwards DNS queries to backend resolvers. The vulnerability affects DoQ and DoH3 protocol handlers, which are modern encrypted DNS transports. The underlying issue stems from improper resource cleanup in error handling paths - when clients send queries that generate error responses (such as invalid queries, timeouts, or backend failures), the error response objects and associated buffers are accumulated in memory but not released until the entire DoQ/DoH3 connection closes. This differs from traditional UDP DNS (port 53), which handles each query independently. The memory leak is triggered per error response, making rapid error generation an effective DoS vector. DoQ uses QUIC (RFC 9250), and DoH3 uses HTTP/3 over QUIC, both connection-oriented protocols where a single TCP-like connection can handle multiple queries.
RemediationAI
Apply the security patch released by PowerDNS per advisory https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html (exact patched version not specified in provided data - consult the advisory directly). The patch corrects resource cleanup in DoQ and DoH3 error handling paths to release buffers immediately rather than deferring release until connection close. If patching cannot be immediately deployed, implement compensating controls: (1) Disable DoQ and DoH3 listeners if not required, reducing attack surface to traditional DNS protocols unaffected by this leak. (2) Implement aggressive connection limits and per-connection query rate limiting in dnsdist configuration to reduce the sustained attack window and memory accumulation rate. (3) Monitor dnsdist process memory usage and set systemd resource limits (MemoryMax, MemoryHigh) or ulimit constraints to prevent OOM-induced service crashes; note this does not prevent the leak but bounds impact. (4) Place dnsdist behind a reverse proxy or firewall that rate-limits or blocks clients generating excessive error rates, though this requires anomaly detection tuning.
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
Remote denial of service in dnsdist allows unauthenticated attackers to crash the DNS load balancer by sending specially
DNSdist fails to validate packet size bounds when rewriting DNS questions or responses via Lua methods (DNSQuestion:chan
Memory exhaustion in DNSdist allows remote, unauthenticated attackers to trigger denial of service by crafting malicious
DNSdist instances using custom Lua code can be crashed via denial of service when the DNSQuestion:getEDNSOptions method
DNSdist is vulnerable to denial of service via out-of-bounds write when processing crafted UDP responses from a rogue ba
PowerDNS dnsdist allows unauthenticated DNS over HTTPS (DoH) queries to bypass access control lists when the early_acl_d
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing d
Denial of service in PowerDNS Authoritative, Recursor, and dnsdist via unbounded memory allocation in their internal web
Unlimited memory allocation in PowerDNS internal web server allows remote denial of service via crafted web requests. Th
dnsdist can be forced into excessive memory allocation when a client generates high volumes of DNS queries routed to an
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | Fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP4 | Fixed |
| SUSE Linux Enterprise Server 15 SP4-LTSS | Fixed |
| SUSE Linux Enterprise Server 15 SP5 | Fixed |
| SUSE Linux Enterprise Server 15 SP5-LTSS | Fixed |
| SUSE Linux Enterprise Server 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Fixed |
| SUSE Manager Proxy 4.3 | Fixed |
| SUSE Manager Proxy LTS 4.3 | Fixed |
| SUSE Manager Retail Branch Server 4.3 | Fixed |
| SUSE Manager Retail Branch Server LTS 4.3 | Fixed |
| SUSE Manager Server 4.3 | Fixed |
| SUSE Manager Server LTS 4.3 | Fixed |
| SUSE CaaS Platform 4.0 | Fixed |
| SUSE Enterprise Storage 7.1 | Fixed |
| SUSE Linux Enterprise Desktop 15 SP4 | Fixed |
| SUSE Linux Enterprise Desktop 15 SP5 | Fixed |
| SUSE Linux Enterprise Desktop 15 SP6 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Fixed |
| SUSE Linux Enterprise Real Time 15 SP4 | Fixed |
| SUSE Linux Enterprise Server 15 SP1-LTSS | Fixed |
| SUSE Linux Enterprise Server 15 SP2-LTSS | Fixed |
| SUSE Linux Enterprise Server 15 SP3-LTSS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today