Vulnerability · Published Jun 25, 2026 · Assigned by OX
CVE-2026-40211Denial of service via crafted DoH3 queries
Medium 5.3
In plain English
A medium-severity resource allocation without limits in DNSdist from PowerDNS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | dnsdist | no fix listed | DEBIAN-CVE-2026-40211 |
| Debian:13 | dnsdist | 1.9.15-0+deb13u1 | DEBIAN-CVE-2026-40211 |
| Debian:14 | dnsdist | 2.1.0-1 | DEBIAN-CVE-2026-40211 |
| Ubuntu:25.10 | dnsdist | no fix listed | UBUNTU-CVE-2026-40211 |
| Ubuntu:26.04:LTS | dnsdist | no fix listed | UBUNTU-CVE-2026-40211 |
| Ubuntu:26.10 | dnsdist | no fix listed | UBUNTU-CVE-2026-40211 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L