EUVD-2026-39347
GHSA-2cpw-vgr2-pw3h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify dnsdist instance with DoH3 enabled
-
DeliveryEstablish QUIC connection to DoH3 listener
-
ExploitSend GET query with crafted invalid DATA frame
-
ExecutionTrigger slow error-handling path in dnsdist
-
ImpactDelay processing of legitimate DoH3 queries
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | DoH3 (DNS over HTTPS/3, using the QUIC transport) must be explicitly configured and enabled on the target dnsdist instance - this is not a default configuration. The attack is delivered over the network without requiring authentication (PR:N), but the CVSS AC:H rating indicates the attacker must successfully establish a QUIC connection and craft a GET request with a specifically invalid DATA frame, which limits opportunistic mass exploitation. Exploitation is further constrained to the DoH3 listener port only; standard DNS (UDP/TCP port 53), DoT, and DoH/2 listeners are unaffected. The impact is limited to processing delay (availability Low), not data exposure or code execution. |
| Impact | The CVSS 3.7 base score (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) signals a low-priority finding. The high attack complexity (AC:H) reflects that exploitation requires DoH3 to be actively configured and listening - this is not a default posture in most dnsdist deployments. The availability impact is rated Low, meaning query processing is delayed rather than fully disrupted. No EPSS data was provided, and the vulnerability is absent from the CISA KEV catalog, confirming no known active exploitation. The tag 'Information Disclosure' supplied in the input data is inconsistent with both the description (processing delay) and the CVSS impact vector (C:N/I:N/A:L); this appears to be a tagging error and should not inform risk decisions. Taken together, this is a real but low-urgency issue that primarily affects operators who have deployed DoH3 listeners and operate them in latency-sensitive environments. |
| Exploit ScenarioDerived | An attacker with network access to a dnsdist instance that has DoH3 enabled sends a stream of DoH3 GET queries over QUIC, each embedding a deliberately malformed HTTP/3 DATA frame. The dnsdist process enters a slow error-handling path for each such frame, accumulating processing delay that causes legitimate DoH3 queries to experience elevated latency or timeouts. No public proof-of-concept code has been identified, and the high attack complexity suggests crafting valid QUIC connections with precisely malformed DATA frames requires meaningful protocol knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Query processing delays in dnsdist's DoH3 (DNS over HTTPS/3) implementation allow unauthenticated remote attackers to partially degrade DNS resolution availability by sending crafted GET requests containing invalid HTTP/3 DATA frames. Affected deployments are limited to those with DoH3 explicitly enabled; the CVSS score of 3.7 reflects high attack complexity and only a low availability impact. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Consult the official PowerDNS security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html to obtain the patched dnsdist release version and apply the vendor-supplied upgrade - an exact fix version was not included in the available intelligence data and cannot be stated here without risking an invented version number. As a compensating control for operators unable to patch immediately, disabling the DoH3 listener entirely removes the attack surface with no impact on DNS-over-UDP, DNS-over-TCP, or DoH (HTTP/2) listeners; this is the most effective interim mitigation. If DoH3 is operationally required, consider placing a rate-limiting reverse proxy or QUIC-aware firewall rule in front of the dnsdist DoH3 port to reduce the volume of malformed frames that reach the listener. Note that rate-limiting will not eliminate the vulnerability but will constrain the potential for sustained delay.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
dnsdist is a high-performance DNS load balancer and proxy developed by PowerDNS (Open-Xchange). This vulnerability resides in its DoH3 listener - the DNS over HTTP/3 implementation, which uses the QUIC transport protocol (IETF RFC 9000). HTTP/3 defines DATA frames as the primary mechanism for carrying request and response payload; when an ill-formed DATA frame is received in the context of a GET-method DoH3 query, the implementation appears to enter an error-handling path that introduces measurable latency rather than immediately discarding the malformed frame. No CWE identifier has been assigned, but the root cause class is consistent with improper input validation or an inefficient error-recovery loop in the HTTP/3 layer. CPE data was not provided, so exact affected version ranges must be obtained from the official PowerDNS advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-delivered with no auth needed, but AC:H because DoH3 must be enabled and frames must be precisely malformed; only low availability impact confirmed.
Primary rating from Vendor (open-xchange).
CVSS VectorVendor: open-xchange
Lifecycle Timeline
1DescriptionCVE.org
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB