Executive brief
PowerDNS DNSdist, a tool used to balance and manage internet traffic for domain name systems, contains a flaw in how it handles modern DNS-over-HTTP/3 (DoH3) requests. An attacker can send specially formatted requests that cause delays in how the system processes legitimate traffic. While this does not expose data, it can slow down the responsiveness of the DNS service for users.
Technical details
A vulnerability exists in the DNS-over-HTTP/3 (DoH3) implementation of PowerDNS DNSdist (specifically within doh3.cc). The issue is triggered when an attacker sends DoH3 GET queries containing an invalid DATA frame. This can lead to a delay in the processing of subsequent DoH3 queries, resulting in a partial denial of service. The attack is network-reachable and requires no authentication, though it has a high attack complexity. The vulnerability is addressed in DNSdist versions 1.9.15 and 2.0.7. Organizations unable to upgrade can mitigate the risk by disabling DoH3 support.
Affected products
- PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6
Timeline
- 2026-04-13: disclosed: Discovery date
- 2026-06-25: advisory: PowerDNS Security Advisory 2026-09 published
- 2026-06-25: patched: Fixed in versions 1.9.15 and 2.0.7