CVE-2026-40209
Denial of service via IXFR queries
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Denial of service via IXFR queries
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
- Record
CVE-2026-40209- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
EUVDEUVD-2026-39348
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
- Record
EUVD-2026-39348- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c5m7-ppm5-wp5g
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a...
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
- Record
GHSA-c5m7-ppm5-wp5g- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
NVD
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
- Record
CVE-2026-40209- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
OSV
Denial of service via IXFR queries
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
- Record
CVE-2026-40209- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40209
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
- Record
DEBIAN-CVE-2026-40209- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2026-40209
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
- Record
UBUNTU-CVE-2026-40209- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11411-1 No score
dnsdist-2.0.7-1.1 on GA media
These are all security issues fixed in the dnsdist-2.0.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11411-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21533-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
openSUSE-SU-2026:21533-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23123-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
SUSE-SU-2026:23123-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23146-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
SUSE-SU-2026:23146-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsdistDebian:12 |
All versions, plus listed versions 1.7.3-21.8.0-11.8.1-11.8.2-11.8.2-2 Show 33 moreShow less1.8.2-31.8.3-11.8.3-21.8.3-31.9.10-11.9.3-11.9.4-11.9.5-11.9.6-11.9.8-11.9.9-12.0.0-12.0.0-22.0.0-32.0.0-42.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-12.1.0-12.1.0-22.1.1-12.1.2-12.1.3-1 |
None known |
dnsdistDebian:13 |
before 1.9.15-0+deb13u1, plus listed versions 1.9.10-11.9.10-1+deb13u11.9.14-0+deb13u1 |
1.9.15-0+deb13u1 |
dnsdistDebian:14 |
before 2.1.0-1, plus listed versions 1.9.10-12.0.0-12.0.0-22.0.0-32.0.0-4 Show 13 moreShow less2.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-1 |
2.1.0-1 |
dnsdistSUSE:Linux Enterprise Server 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
dnsdistSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
dnsdistUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.0~alpha2-1 |
None known |
dnsdistUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1 |
None known |
dnsdistUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.0~rc3-11.4.0-11.4.0-1build11.4.0-1build21.4.0-1ubuntu0.1~esm1 |
None known |
dnsdistUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.5.1-3build21.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2 |
None known |
dnsdistUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.8.0-11.8.2-11.8.2-21.8.2-31.8.3-1 Show 4 moreShow less1.8.3-21.8.3-2build11.8.3-2build21.8.3-2ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dnsdistUbuntu:25.10 |
All versions, plus listed versions 1.9.8-11.9.10-11.9.10-1ubuntu0.1 |
None known |
dnsdistUbuntu:26.10 |
All versions, plus listed versions 2.0.2-1build12.0.5-2ubuntu12.0.5-2ubuntu3 |
None known |
dnsdistUbuntu:26.04:LTS |
All versions, plus listed versions 1.9.10-12.0.1-12.0.2-12.0.2-1build1 |
None known |
dnsdistopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 2.0.7-1.1 | 2.0.7-1.1 |
dnsdistopenSUSE:Leap 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40209 is a medium vulnerability (CVSS 5.3) in Powerdns Dnsdist, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in dnsdist 1.9.15-0+deb13u1.
References
dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html
nvd.nist.gov/vuln/detail/CVE-2026-40209
github.com/advisories/GHSA-c5m7-ppm5-wp5g
repo.powerdns.com
Show 19 moreShow less
security-tracker.debian.org/tracker/CVE-2026-40209
suse.com/support/update/announcement/2026/suse-su-202623123-1
bugzilla.suse.com/1269201
ubuntu.com/security/CVE-2026-40209
cve.org/CVERecord?id=CVE-2026-40209