dnsdist CVE-2026-40211

Upgrade dnsdist to the patched version specified in the PowerDNS security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html - the exact fixed release version is not independently confirmed from available input data, so the advisory must be consulted for the precise target version. As an immediately actionable compensating control, disable the DoH3 (DNS over HTTP/3 over QUIC) listener on any dnsdist instance where this feature is not operationally required; this eliminates the attack surface entirely with no impact on traditional DNS or DoH (HTTP/1.1 or HTTP/2) traffic. If DoH3 must remain enabled, consider rate-limiting concurrent QUIC streams per source IP at the network perimeter or within dnsdist's own configuration to limit the amplification potential; note that aggressive stream limits may degrade legitimate high-volume DoH3 clients. Memory limits on the dnsdist process (e.g., via systemd MemoryMax or cgroups) can serve as a last-resort backstop to contain blast radius but will not prevent denial of service - they will merely bound collateral damage to the host.