dnsdist EUVD-2026-24931

Apply the patched version of dnsdist released by PowerDNS in response to advisory 2026-04, available at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html. The patch implements bounded buffer allocation and query discarding for overloaded DoH backends. Until patching is feasible, implement rate-limiting on inbound DNS queries using dnsdist's query rate-limiting rules to cap queries from individual clients or subnets, reducing buffer accumulation. Additionally, configure backend health checks and failover to alternative DoH servers to prevent sustained overload conditions. Monitor memory usage on dnsdist instances with DoH backends and set alerts to trigger on sustained memory growth above baseline; consider implementing memory limits via operating system controls (cgroups, ulimit) as a fail-safe. These mitigations reduce attack impact but do not eliminate the root cause and should be treated as temporary measures pending patch deployment.