# CVE-2026-40210: PowerDNS DNSdist out-of-bounds read in SetMacAddrAction

Source: https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-40210 · Severity: medium · CVSS 4.8 · Published 2026-06-25

PowerDNS DNSdist, a popular tool for balancing and filtering DNS traffic, contains a flaw in its MAC address handling feature. An attacker could exploit this to cause the service to crash or to leak sensitive internal memory data over the network. This could lead to service interruptions or provide an attacker with information useful for further attacks.

Technologies: [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-40210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40210 being exploited in the wild.

**How severe is CVE-2026-40210?** Medium severity, with a CVSS score of 4.8, published 25 June 2026.

**Which products and versions are affected?** Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.

**Is there a fix for CVE-2026-40210?** A patch was published on 2026-06-25: Fixed versions 1.9.15 and 2.0.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40210 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-40210?** Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in PowerDNS DNSdist within the SetMacAddrAction component (specifically in dnsdist-actions-factory.cc). The flaw is triggered when SetMacAddrAction is used to process DNS queries, potentially leading to the transmission of uninitialized memory over the network or a process crash. The attack is network-reachable and requires no authentication, though it has high complexity as it depends on specific configuration and timing. The issue affects versions 1.9.x up to 1.9.14 and 2.0.x up to 2.0.6. It has been patched in versions 1.9.15 and 2.0.7.

## Affected products

- PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6

## Timeline

- 2026-04-13: disclosed: Discovery date
- 2026-06-25: advisory: PowerDNS Security Advisory 2026-09 published
- 2026-06-25: patched: Fixed versions 1.9.15 and 2.0.7 released

## References

- [https://repo.powerdns.com/](https://repo.powerdns.com/)
- [https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html](https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html)

## Related threats

- [PowerDNS DNSdist EDNS options smuggling in EDNS processing](https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing)
- [PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3)
- [PowerDNS DNSdist denial of service via IXFR queries](https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries)
- [PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries)
- [PowerDNS DNSdist denial of service in Prometheus endpoint](https://junglewise.ai/threats/cve-2026-40011-powerdns-dnsdist-denial-of-service-in-prometheus-endpoint)