CVE-2026-40211
Denial of service via crafted DoH3 queries
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Denial of service via crafted DoH3 queries
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
- Record
CVE-2026-40211- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-39350
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
- Record
EUVD-2026-39350- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8mqg-g8g6-fvw6
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some...
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
- Record
GHSA-8mqg-g8g6-fvw6- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
- Record
CVE-2026-40211- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Denial of service via crafted DoH3 queries
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
- Record
CVE-2026-40211- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40211
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
- Record
DEBIAN-CVE-2026-40211- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2026-40211
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
- Record
UBUNTU-CVE-2026-40211- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11411-1 No score
dnsdist-2.0.7-1.1 on GA media
These are all security issues fixed in the dnsdist-2.0.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11411-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21533-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
openSUSE-SU-2026:21533-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23123-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
SUSE-SU-2026:23123-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23146-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
SUSE-SU-2026:23146-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsdistDebian:12 |
All versions, plus listed versions 1.7.3-21.8.0-11.8.1-11.8.2-11.8.2-2 Show 33 moreShow less1.8.2-31.8.3-11.8.3-21.8.3-31.9.10-11.9.3-11.9.4-11.9.5-11.9.6-11.9.8-11.9.9-12.0.0-12.0.0-22.0.0-32.0.0-42.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-12.1.0-12.1.0-22.1.1-12.1.2-12.1.3-1 |
None known |
dnsdistDebian:13 |
before 1.9.15-0+deb13u1, plus listed versions 1.9.10-11.9.10-1+deb13u11.9.14-0+deb13u1 |
1.9.15-0+deb13u1 |
dnsdistDebian:14 |
before 2.1.0-1, plus listed versions 1.9.10-12.0.0-12.0.0-22.0.0-32.0.0-4 Show 13 moreShow less2.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-1 |
2.1.0-1 |
dnsdistSUSE:Linux Enterprise Server 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
dnsdistSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
dnsdistUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.0~alpha2-1 |
None known |
dnsdistUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1 |
None known |
dnsdistUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.0~rc3-11.4.0-11.4.0-1build11.4.0-1build21.4.0-1ubuntu0.1~esm1 |
None known |
dnsdistUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.5.1-3build21.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2 |
None known |
dnsdistUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.8.0-11.8.2-11.8.2-21.8.2-31.8.3-1 Show 4 moreShow less1.8.3-21.8.3-2build11.8.3-2build21.8.3-2ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dnsdistUbuntu:25.10 |
All versions, plus listed versions 1.9.8-11.9.10-11.9.10-1ubuntu0.1 |
None known |
dnsdistUbuntu:26.10 |
All versions, plus listed versions 2.0.2-1build12.0.5-2ubuntu12.0.5-2ubuntu3 |
None known |
dnsdistUbuntu:26.04:LTS |
All versions, plus listed versions 1.9.10-12.0.1-12.0.2-12.0.2-1build1 |
None known |
dnsdistopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 2.0.7-1.1 | 2.0.7-1.1 |
dnsdistopenSUSE:Leap 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40211 is a medium vulnerability (CVSS 5.3) in Powerdns Dnsdist, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in dnsdist 1.9.15-0+deb13u1.
References
dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html
nvd.nist.gov/vuln/detail/CVE-2026-40211
github.com/advisories/GHSA-8mqg-g8g6-fvw6
repo.powerdns.com
Show 19 moreShow less
security-tracker.debian.org/tracker/CVE-2026-40211
suse.com/support/update/announcement/2026/suse-su-202623123-1
bugzilla.suse.com/1269201
ubuntu.com/security/CVE-2026-40211
cve.org/CVERecord?id=CVE-2026-40211