Is CVE-2026-40209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40209 being exploited in the wild.

How severe is CVE-2026-40209?

Medium severity, with a CVSS score of 5.3, published 25 June 2026.

Which products and versions are affected?

Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.

Is there a fix for CVE-2026-40209?

A patch was published on 2026-06-25: Fixed versions 1.9.15 and 2.0.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40209 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-40209?

Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40209: PowerDNS DNSdist denial of service via IXFR queries

CVE-2026-40209 · Severity: medium · CVSS 5.3 · Published 2026-06-25

PowerDNS DNSdist is a load balancer used to manage and route DNS traffic to backend servers. A vulnerability in how it handles specific DNS update requests (IXFR) allows an attacker to tie up connections between the load balancer and the backend servers. This can lead to a denial of service where the system can no longer process legitimate traffic because it has run out of available connections or system resources.

Technologies: Powerdns Dnsdist. Vendors: Powerdns.

Quick answers

Is CVE-2026-40209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40209 being exploited in the wild.
How severe is CVE-2026-40209?: Medium severity, with a CVSS score of 5.3, published 25 June 2026.
Which products and versions are affected?: Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.
Is there a fix for CVE-2026-40209?: A patch was published on 2026-06-25: Fixed versions 1.9.15 and 2.0.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40209 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-40209?: Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource management vulnerability (CWE-772) exists in PowerDNS DNSdist's handling of Incremental Zone Transfer (IXFR) queries. By sending crafted IXFR queries, a remote unauthenticated attacker can prevent outgoing TCP connections to backend servers from being released immediately, forcing them to remain open until a timeout occurs. This can lead to resource exhaustion, specifically reaching the maximum number of concurrent backend connections or exhausting the process's file descriptors, resulting in a denial of service. The issue affects DNSdist versions 1.9.x up to 1.9.14 and 2.0.x up to 2.0.6. Patches are available in versions 1.9.15 and 2.0.7.

Affected products

PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6

Timeline

2026-04-13: disclosed: Discovery date
2026-06-25: advisory: PowerDNS Security Advisory 2026-09 published
2026-06-25: patched: Fixed versions 1.9.15 and 2.0.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.