EUVD-2026-39347
GHSA-2cpw-vgr2-pw3h
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-delivered with no auth needed, but AC:H because DoH3 must be enabled and frames must be precisely malformed; only low availability impact confirmed.
Primary rating from Vendor (open-xchange).
CVSS VectorVendor: open-xchange
Lifecycle Timeline
2DescriptionCVE.org
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
AnalysisAI
Query processing delays in dnsdist's DoH3 (DNS over HTTPS/3) implementation allow unauthenticated remote attackers to partially degrade DNS resolution availability by sending crafted GET requests containing invalid HTTP/3 DATA frames. Affected deployments are limited to those with DoH3 explicitly enabled; the CVSS score of 3.7 reflects high attack complexity and only a low availability impact. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
dnsdist is a high-performance DNS load balancer and proxy developed by PowerDNS (Open-Xchange). This vulnerability resides in its DoH3 listener - the DNS over HTTP/3 implementation, which uses the QUIC transport protocol (IETF RFC 9000). HTTP/3 defines DATA frames as the primary mechanism for carrying request and response payload; when an ill-formed DATA frame is received in the context of a GET-method DoH3 query, the implementation appears to enter an error-handling path that introduces measurable latency rather than immediately discarding the malformed frame. No CWE identifier has been assigned, but the root cause class is consistent with improper input validation or an inefficient error-recovery loop in the HTTP/3 layer. CPE data was not provided, so exact affected version ranges must be obtained from the official PowerDNS advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html.
RemediationAI
Consult the official PowerDNS security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html to obtain the patched dnsdist release version and apply the vendor-supplied upgrade - an exact fix version was not included in the available intelligence data and cannot be stated here without risking an invented version number. As a compensating control for operators unable to patch immediately, disabling the DoH3 listener entirely removes the attack surface with no impact on DNS-over-UDP, DNS-over-TCP, or DoH (HTTP/2) listeners; this is the most effective interim mitigation. If DoH3 is operationally required, consider placing a rate-limiting reverse proxy or QUIC-aware firewall rule in front of the dnsdist DoH3 port to reduce the volume of malformed frames that reach the listener. Note that rate-limiting will not eliminate the vulnerability but will constrain the potential for sustained delay.
Same weakness CWE-705 – Incorrect Control Flow Scoping
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today