EUVD-2026-39346
GHSA-f83r-q8f4-f336
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AV:N and PR:N reflect unauthenticated DNS query submission; AC:H for the sustained crafted-query requirement; A:L added over vendor score to capture temporary Prometheus endpoint unavailability.
Primary rating from Vendor (open-xchange).
CVSS VectorVendor: open-xchange
Lifecycle Timeline
2DescriptionCVE.org
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
AnalysisAI
Prometheus metrics endpoint corruption in PowerDNS dnsdist allows a remote unauthenticated attacker to disrupt monitoring visibility by flooding the resolver with crafted DNS queries. The flood triggers insertion of a dynamic block whose value serialises into invalid Prometheus exposition format, causing the /metrics endpoint to be rejected by the scraper until the dynamic block TTL expires naturally. No public exploit code is identified at time of analysis, and exploitation requires high attack complexity - a sustained, high-volume crafted query campaign - keeping real-world risk low despite network accessibility.
Technical ContextAI
dnsdist is PowerDNS's open-source DNS load balancer and proxy, widely deployed at ISP and enterprise DNS tiers to distribute, filter, and rate-limit DNS traffic. It supports dynamic blocking rules inserted at runtime in response to observed traffic patterns. Block metadata, including the block's associated value, is reflected in the Prometheus /metrics scrape endpoint using the Prometheus text exposition format. This CVE exploits a boundary or encoding condition in how dynamic-block values are serialised for that endpoint: a specially shaped DNS query pattern produces a block entry whose value contains characters or structure that violates Prometheus exposition format syntax, causing the scraper to reject the entire response body. No CWE is assigned in the advisory; the root-cause class is consistent with improper output neutralisation of dynamic state written into a structured metrics format - analogous to CWE-116 - where insufficient validation allows runtime data to corrupt the output encoding.
RemediationAI
The primary remediation is to apply the vendor-released patch documented in the PowerDNS dnsdist security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html; exact fix version numbers are not confirmed in the available data and must be obtained directly from the advisory. As an interim compensating control, restrict access to the Prometheus /metrics endpoint to trusted internal scraper IPs only via firewall rules or dnsdist's built-in ACL configuration - this does not prevent crafted DNS queries from reaching the resolver but limits the monitoring disruption to controlled scraper clients and reduces the attacker's ability to observe whether the trigger succeeded. Additionally, rate-limiting inbound DNS query volumes from untrusted sources at the network perimeter raises the cost of triggering the condition (exploitation requires a high query volume, per AC:H), though this must be tuned carefully to avoid impacting legitimate high-volume DNS clients. Disabling the Prometheus endpoint entirely eliminates the vulnerable surface at the cost of losing metrics visibility.
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today