PowerDNS dnsdist EUVD-2026-39348

The primary remediation is to upgrade dnsdist to the fixed version specified in the vendor security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html. The exact fix version was not present in the provided input data and must be confirmed directly from that advisory before upgrading. As a compensating control prior to patching, operators should apply dnsdist ACL rules to restrict IXFR query acceptance to known, trusted source IPs (e.g., authorized zone transfer partners), preventing arbitrary internet clients from triggering the vulnerable code path; this is the highest-value short-term mitigation with minimal operational trade-off for most deployments. Additionally, raising the OS-level file descriptor limit for the dnsdist process increases the threshold required to exhaust resources, buying more time before service impact occurs, though this does not eliminate the leak. Rate-limiting IXFR queries per source IP at the dnsdist or upstream firewall layer can reduce the speed at which an attacker accumulates stuck connections. TCP keepalive tuning to shorten stuck-connection timeout windows will accelerate resource reclamation but may interfere with legitimate long-running zone transfers.