Executive brief
DNSdist is a load balancer used to manage and route internet traffic for DNS services. A vulnerability in how it handles modern encrypted web-based DNS requests (DoQ and DoH3) allows an attacker to force the system to consume excessive memory. This can lead to a service outage or system crash, preventing legitimate users from resolving website addresses.
Technical details
A memory allocation vulnerability (CWE-789) exists in DNSdist's handling of DNS over QUIC (DoQ) and DNS over HTTP/3 (DoH3) payloads. The root cause is located in the 'doq.cc' and 'doh3.cc' modules, where incoming payloads can trick the service into allocating excessive memory. While systems with high memory availability may only experience a closed connection and an exception, systems with limited resources may enter an out-of-memory (OOM) state, leading to process termination and denial of service. The attack is network-reachable and requires no authentication or user interaction. The issue is fixed in DNSdist versions 1.9.12 and 2.0.3.
Affected products
- PowerDNS DNSdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2
Timeline
- 2026-02-17: disclosed: Discovery date reported by vendor
- 2026-03-31: advisory: PowerDNS Security Advisory 2026-02 published
- 2026-03-31: patched: Fixed versions 1.9.12 and 2.0.3 released