# CVE-2026-24030: PowerDNS DNSdist denial of service via unbounded memory allocation in DoQ and DoH3

Source: https://junglewise.ai/threats/cve-2026-24030-powerdns-dnsdist-denial-of-service-via-unbounded-memory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-24030 · Severity: medium · CVSS 5.3 · Published 2026-03-31

DNSdist is a load balancer used to manage and route internet traffic for DNS services. A vulnerability in how it handles modern encrypted web-based DNS requests (DoQ and DoH3) allows an attacker to force the system to consume excessive memory. This can lead to a service outage or system crash, preventing legitimate users from resolving website addresses.

Technologies: [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-24030 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24030 being exploited in the wild.

**How severe is CVE-2026-24030?** Medium severity, with a CVSS score of 5.3, published 31 March 2026.

**Which products and versions are affected?** Powerdns Dnsdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2.

**Is there a fix for CVE-2026-24030?** A patch was published on 2026-03-31: Fixed versions 1.9.12 and 2.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-24030 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-24030?** Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory allocation vulnerability (CWE-789) exists in DNSdist's handling of DNS over QUIC (DoQ) and DNS over HTTP/3 (DoH3) payloads. The root cause is located in the 'doq.cc' and 'doh3.cc' modules, where incoming payloads can trick the service into allocating excessive memory. While systems with high memory availability may only experience a closed connection and an exception, systems with limited resources may enter an out-of-memory (OOM) state, leading to process termination and denial of service. The attack is network-reachable and requires no authentication or user interaction. The issue is fixed in DNSdist versions 1.9.12 and 2.0.3.

## Affected products

- PowerDNS DNSdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2

## Timeline

- 2026-02-17: disclosed: Discovery date reported by vendor
- 2026-03-31: advisory: PowerDNS Security Advisory 2026-02 published
- 2026-03-31: patched: Fixed versions 1.9.12 and 2.0.3 released

## References

- [https://repo.powerdns.com/](https://repo.powerdns.com/)
- [https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html](https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html)

## Related threats

- [PowerDNS DNSdist EDNS options smuggling in EDNS processing](https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing)
- [PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3)
- [PowerDNS DNSdist out-of-bounds read in SetMacAddrAction](https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction)
- [PowerDNS DNSdist denial of service via IXFR queries](https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries)
- [PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries)