Executive brief
PowerDNS DNSdist is a load balancer used to manage and route DNS traffic. A vulnerability in its monitoring component allows an attacker to send specifically crafted DNS queries that corrupt the data exported to monitoring tools like Prometheus. This causes monitoring systems to reject the data, effectively blinding administrators to the health and performance of the DNS load balancer until the malicious data expires.
Technical details
A vulnerability exists in the Prometheus export module of PowerDNS DNSdist (specifically within dnsdist-web.cc). By sending a large volume of crafted DNS queries, an attacker can trigger the insertion of a dynamic block with a value that results in malformed output at the Prometheus metrics endpoint. This invalid formatting causes external monitoring scrapers to fail when parsing the endpoint, leading to a localized denial of service for monitoring telemetry. The issue persists until the dynamic block expires. The vulnerability affects versions 1.9.x prior to 1.9.15 and 2.0.x prior to 2.0.7. Remediation involves upgrading to versions 1.9.15 or 2.0.7, or disabling the use of suffix match rules in dynamic blocks.
Affected products
- PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6
Timeline
- 2026-04-07: other: Vulnerability discovered
- 2026-06-25: advisory: PowerDNS Security Advisory 2026-09 published
- 2026-06-25: disclosed: CVE published to NVD