Executive brief
PowerDNS DNSdist is a load balancer used to manage and route DNS traffic to backend servers. A vulnerability in how it handles specific DNS update requests (IXFR) allows an attacker to tie up connections between the load balancer and the backend servers. This can lead to a denial of service where the system can no longer process legitimate traffic because it has run out of available connections or system resources.
Technical details
A resource management vulnerability (CWE-772) exists in PowerDNS DNSdist's handling of Incremental Zone Transfer (IXFR) queries. By sending crafted IXFR queries, a remote unauthenticated attacker can prevent outgoing TCP connections to backend servers from being released immediately, forcing them to remain open until a timeout occurs. This can lead to resource exhaustion, specifically reaching the maximum number of concurrent backend connections or exhausting the process's file descriptors, resulting in a denial of service. The issue affects DNSdist versions 1.9.x up to 1.9.14 and 2.0.x up to 2.0.6. Patches are available in versions 1.9.15 and 2.0.7.
Affected products
- PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6
Timeline
- 2026-04-13: disclosed: Discovery date
- 2026-06-25: advisory: PowerDNS Security Advisory 2026-09 published
- 2026-06-25: patched: Fixed versions 1.9.15 and 2.0.7 released