dnsdist EUVD-2026-24933

Apply the security patch released by PowerDNS per advisory https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html (exact patched version not specified in provided data - consult the advisory directly). The patch corrects resource cleanup in DoQ and DoH3 error handling paths to release buffers immediately rather than deferring release until connection close. If patching cannot be immediately deployed, implement compensating controls: (1) Disable DoQ and DoH3 listeners if not required, reducing attack surface to traditional DNS protocols unaffected by this leak. (2) Implement aggressive connection limits and per-connection query rate limiting in dnsdist configuration to reduce the sustained attack window and memory accumulation rate. (3) Monitor dnsdist process memory usage and set systemd resource limits (MemoryMax, MemoryHigh) or ulimit constraints to prevent OOM-induced service crashes; note this does not prevent the leak but bounds impact. (4) Place dnsdist behind a reverse proxy or firewall that rate-limits or blocks clients generating excessive error rates, though this requires anomaly detection tuning.