PT-2026-52383 · Powerdns · Dnsdist

Mehtab Zafar · Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-40211

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.

Correção

Identificadores relacionados

CVE-2026-40211

Produtos afetados

Dnsdist

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-40211 · Nota de Segurança
• https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html · Nota