# CVE-2026-40011: PowerDNS DNSdist denial of service in Prometheus endpoint

Source: https://junglewise.ai/threats/cve-2026-40011-powerdns-dnsdist-denial-of-service-in-prometheus-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-40011 · Severity: low · CVSS 3.7 · Published 2026-06-25

PowerDNS DNSdist is a load balancer used to manage and route DNS traffic. A vulnerability in its monitoring component allows an attacker to send specifically crafted DNS queries that corrupt the data exported to monitoring tools like Prometheus. This causes monitoring systems to reject the data, effectively blinding administrators to the health and performance of the DNS load balancer until the malicious data expires.

Technologies: [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-40011 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40011 being exploited in the wild.

**How severe is CVE-2026-40011?** Low severity, with a CVSS score of 3.7, published 25 June 2026.

**Which products and versions are affected?** Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.

**Is there a fix for CVE-2026-40011?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40011 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40011?** Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Prometheus export module of PowerDNS DNSdist (specifically within dnsdist-web.cc). By sending a large volume of crafted DNS queries, an attacker can trigger the insertion of a dynamic block with a value that results in malformed output at the Prometheus metrics endpoint. This invalid formatting causes external monitoring scrapers to fail when parsing the endpoint, leading to a localized denial of service for monitoring telemetry. The issue persists until the dynamic block expires. The vulnerability affects versions 1.9.x prior to 1.9.15 and 2.0.x prior to 2.0.7. Remediation involves upgrading to versions 1.9.15 or 2.0.7, or disabling the use of suffix match rules in dynamic blocks.

## Affected products

- PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6

## Timeline

- 2026-04-07: other: Vulnerability discovered
- 2026-06-25: advisory: PowerDNS Security Advisory 2026-09 published
- 2026-06-25: disclosed: CVE published to NVD

## References

- [https://repo.powerdns.com/](https://repo.powerdns.com/)
- [https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html](https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html)

## Related threats

- [PowerDNS DNSdist EDNS options smuggling in EDNS processing](https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing)
- [PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3)
- [PowerDNS DNSdist out-of-bounds read in SetMacAddrAction](https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction)
- [PowerDNS DNSdist denial of service via IXFR queries](https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries)
- [PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries)