dnsdist CVE-2026-33595

DoQ (DNS-over-QUIC) or DoH3 (DNS-over-HTTPS/3) protocol support must be enabled and exposed on the dnsdist instance. These are not enabled by default in all dnsdist deployments - instances configured for traditional DNS (UDP port 53 and TCP port 53) with no DoQ/DoH3 listeners are not vulnerable. The attacker must be able to send DNS queries to the exposed DoQ/DoH3 listener (typically requires network connectivity to the dnsdist instance and no IP-based filtering). No authentication is required. The vulnerability is triggered by sending error-generating queries (invalid queries, queries to non-responsive backends, or other conditions that produce error responses), which are normal DNS operations. The attacker's ability to sustain the attack depends on connection limits and per-connection query rate limits configured in dnsdist; aggressive limits reduce but do not eliminate the risk.

CVSS 5.3 with AV:N/AC:L/PR:N/UI:N/S:U indicates unauthenticated remote network attackers can trigger availability impact with no special conditions. AC:L and PR:N confirm the attack requires no authentication or complex setup. The vector is network-accessible, making this broadly exploitable against any dnsdist instance exposing DoQ or DoH3. However, S:U (scope unchanged) and A:L (partial availability impact) suggest the attack causes temporary unavailability rather than complete system compromise. The practical risk depends on: (1) whether the target dnsdist instance has DoQ/DoH3 enabled (not default on all deployments), (2) attacker's ability to sustain concurrent connections and generate errors rapidly, and (3) system memory capacity and connection limits. The attack is connection-bounded - closing connections releases memory, limiting sustained impact compared to other memory exhaustion attacks. No EPSS, KEV, or public POC data provided; exploitation probability and real-world threat level cannot be independently verified. Organizations running dnsdist primarily for traditional DNS (UDP/TCP) or with DoQ/DoH3 disabled face minimal risk.

An attacker opens a single DoQ or DoH3 connection to a vulnerable dnsdist instance and rapidly sends crafted DNS queries designed to generate error responses (e.g., malformed queries, queries for non-existent domains when backend is misconfigured, or other error conditions). Each error response object remains in memory without being freed. Over seconds to minutes, the attacker accumulates sufficient memory pressure to degrade or exhaust the dnsdist process, causing queries from legitimate users to timeout or the service to crash if memory is exhausted. The connection-based nature means the attacker only needs one or two connections to sustain the attack, making detection more difficult than multi-connection flood attacks.