Executive brief
PowerDNS DNSdist, a load balancer used to manage and protect DNS traffic, is vulnerable to a denial-of-service attack when handling specific web-based DNS queries. An attacker can send specially crafted requests that cause the system to consume memory without releasing it immediately. If enough of these requests are sent, the system may run out of memory and stop responding to legitimate DNS traffic, potentially disrupting internet connectivity for users.
Technical details
A vulnerability in the DNS over HTTP/3 (DoH3) implementation of PowerDNS DNSdist allows an unauthenticated remote attacker to trigger an exception by sending crafted queries. This exception prevents internal buffers from being freed immediately; instead, they remain allocated until the underlying QUIC connection is terminated. By opening a large number of concurrent DoH3 streams, an attacker can exhaust available system memory, resulting in an out-of-memory (OOM) condition and a denial of service. The issue is rooted in the DoH3 processing logic within dnsdist-crypto.cc and is fixed in versions 1.9.15 and 2.0.7.
Affected products
- PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6
Timeline
- 2026-04-09: disclosed: Discovery date
- 2026-06-25: advisory: Public advisory released by PowerDNS
- 2026-06-25: patched: Fixed in versions 1.9.15 and 2.0.7