# CVE-2026-40209: PowerDNS DNSdist denial of service via IXFR queries

Source: https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-40209 · Severity: medium · CVSS 5.3 · Published 2026-06-25

PowerDNS DNSdist is a load balancer used to manage and route DNS traffic to backend servers. A vulnerability in how it handles specific DNS update requests (IXFR) allows an attacker to tie up connections between the load balancer and the backend servers. This can lead to a denial of service where the system can no longer process legitimate traffic because it has run out of available connections or system resources.

Technologies: [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-40209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40209 being exploited in the wild.

**How severe is CVE-2026-40209?** Medium severity, with a CVSS score of 5.3, published 25 June 2026.

**Which products and versions are affected?** Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.

**Is there a fix for CVE-2026-40209?** A patch was published on 2026-06-25: Fixed versions 1.9.15 and 2.0.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40209 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-40209?** Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource management vulnerability (CWE-772) exists in PowerDNS DNSdist's handling of Incremental Zone Transfer (IXFR) queries. By sending crafted IXFR queries, a remote unauthenticated attacker can prevent outgoing TCP connections to backend servers from being released immediately, forcing them to remain open until a timeout occurs. This can lead to resource exhaustion, specifically reaching the maximum number of concurrent backend connections or exhausting the process's file descriptors, resulting in a denial of service. The issue affects DNSdist versions 1.9.x up to 1.9.14 and 2.0.x up to 2.0.6. Patches are available in versions 1.9.15 and 2.0.7.

## Affected products

- PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6

## Timeline

- 2026-04-13: disclosed: Discovery date
- 2026-06-25: advisory: PowerDNS Security Advisory 2026-09 published
- 2026-06-25: patched: Fixed versions 1.9.15 and 2.0.7 released

## References

- [https://repo.powerdns.com/](https://repo.powerdns.com/)
- [https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html](https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html)

## Related threats

- [PowerDNS DNSdist EDNS options smuggling in EDNS processing](https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing)
- [PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3)
- [PowerDNS DNSdist out-of-bounds read in SetMacAddrAction](https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction)
- [PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries)
- [PowerDNS DNSdist denial of service in Prometheus endpoint](https://junglewise.ai/threats/cve-2026-40011-powerdns-dnsdist-denial-of-service-in-prometheus-endpoint)