Is CVE-2026-40011 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40011 being exploited in the wild.

How severe is CVE-2026-40011?

Low severity, with a CVSS score of 3.7, published 25 June 2026.

Which products and versions are affected?

Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.

Is there a fix for CVE-2026-40011?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40011 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40011?

Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40011: PowerDNS DNSdist denial of service in Prometheus endpoint

CVE-2026-40011 · Severity: low · CVSS 3.7 · Published 2026-06-25

PowerDNS DNSdist is a load balancer used to manage and route DNS traffic. A vulnerability in its monitoring component allows an attacker to send specifically crafted DNS queries that corrupt the data exported to monitoring tools like Prometheus. This causes monitoring systems to reject the data, effectively blinding administrators to the health and performance of the DNS load balancer until the malicious data expires.

Technologies: Powerdns Dnsdist. Vendors: Powerdns.

Quick answers

Is CVE-2026-40011 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40011 being exploited in the wild.
How severe is CVE-2026-40011?: Low severity, with a CVSS score of 3.7, published 25 June 2026.
Which products and versions are affected?: Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.
Is there a fix for CVE-2026-40011?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40011 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40011?: Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Prometheus export module of PowerDNS DNSdist (specifically within dnsdist-web.cc). By sending a large volume of crafted DNS queries, an attacker can trigger the insertion of a dynamic block with a value that results in malformed output at the Prometheus metrics endpoint. This invalid formatting causes external monitoring scrapers to fail when parsing the endpoint, leading to a localized denial of service for monitoring telemetry. The issue persists until the dynamic block expires. The vulnerability affects versions 1.9.x prior to 1.9.15 and 2.0.x prior to 2.0.7. Remediation involves upgrading to versions 1.9.15 or 2.0.7, or disabling the use of suffix match rules in dynamic blocks.

Affected products

PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6

Timeline

2026-04-07: other: Vulnerability discovered
2026-06-25: advisory: PowerDNS Security Advisory 2026-09 published
2026-06-25: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.