dnsdist CVE-2026-40210

The primary remediation is to upgrade dnsdist to the fixed version specified in the PowerDNS security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html - no specific patch version number is derivable from the available data, so that advisory must be consulted directly. As an immediate compensating control for operators who do not require SetMacAddrAction functionality, removing or disabling that action from the dnsdist ruleset entirely eliminates the vulnerable code path with no broader DNS traffic impact beyond the loss of MAC-stamping behavior. For operators who legitimately rely on SetMacAddrAction, restricting network access to the dnsdist listener to trusted upstream resolvers or internal RFC 1918 ranges using host-based firewall rules or network ACLs will reduce the population of potential attackers able to trigger the read; note this is a risk-reduction measure, not a fix, and the underlying flaw remains. Monitoring dnsdist process stability for unexpected crashes may help detect exploitation attempts in the interim.