CVE-2026-40011
Prometheus denial of service via crafted DNS queries
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Prometheus denial of service via crafted DNS queries
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
- Record
CVE-2026-40011- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
EUVDEUVD-2026-39346
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
- Record
EUVD-2026-39346- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f83r-q8f4-f336
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic...
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
- Record
GHSA-f83r-q8f4-f336- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
NVD
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
- Record
CVE-2026-40011- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSV
Prometheus denial of service via crafted DNS queries
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
- Record
CVE-2026-40011- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40011
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
- Record
DEBIAN-CVE-2026-40011- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2026-40011
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
- Record
UBUNTU-CVE-2026-40011- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11411-1 No score
dnsdist-2.0.7-1.1 on GA media
These are all security issues fixed in the dnsdist-2.0.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11411-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21533-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
openSUSE-SU-2026:21533-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23123-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
SUSE-SU-2026:23123-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23146-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
SUSE-SU-2026:23146-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsdistDebian:12 |
All versions, plus listed versions 1.7.3-21.8.0-11.8.1-11.8.2-11.8.2-2 Show 33 moreShow less1.8.2-31.8.3-11.8.3-21.8.3-31.9.10-11.9.3-11.9.4-11.9.5-11.9.6-11.9.8-11.9.9-12.0.0-12.0.0-22.0.0-32.0.0-42.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-12.1.0-12.1.0-22.1.1-12.1.2-12.1.3-1 |
None known |
dnsdistDebian:13 |
before 1.9.15-0+deb13u1, plus listed versions 1.9.10-11.9.10-1+deb13u11.9.14-0+deb13u1 |
1.9.15-0+deb13u1 |
dnsdistDebian:14 |
before 2.1.0-1, plus listed versions 1.9.10-12.0.0-12.0.0-22.0.0-32.0.0-4 Show 13 moreShow less2.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-1 |
2.1.0-1 |
dnsdistSUSE:Linux Enterprise Server 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
dnsdistSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
dnsdistUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.0~alpha2-1 |
None known |
dnsdistUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1 |
None known |
dnsdistUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.0~rc3-11.4.0-11.4.0-1build11.4.0-1build21.4.0-1ubuntu0.1~esm1 |
None known |
dnsdistUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.5.1-3build21.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2 |
None known |
dnsdistUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.8.0-11.8.2-11.8.2-21.8.2-31.8.3-1 Show 4 moreShow less1.8.3-21.8.3-2build11.8.3-2build21.8.3-2ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dnsdistUbuntu:25.10 |
All versions, plus listed versions 1.9.8-11.9.10-11.9.10-1ubuntu0.1 |
None known |
dnsdistUbuntu:26.10 |
All versions, plus listed versions 2.0.2-1build12.0.5-2ubuntu12.0.5-2ubuntu3 |
None known |
dnsdistUbuntu:26.04:LTS |
All versions, plus listed versions 1.9.10-12.0.1-12.0.2-12.0.2-1build1 |
None known |
dnsdistopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 2.0.7-1.1 | 2.0.7-1.1 |
dnsdistopenSUSE:Leap 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40011 is a low vulnerability (CVSS 3.7) in Powerdns Dnsdist, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in dnsdist 1.9.15-0+deb13u1.
References
dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html
nvd.nist.gov/vuln/detail/CVE-2026-40011
github.com/advisories/GHSA-f83r-q8f4-f336
repo.powerdns.com
Show 19 moreShow less
security-tracker.debian.org/tracker/CVE-2026-40011
suse.com/support/update/announcement/2026/suse-su-202623123-1
bugzilla.suse.com/1269201
ubuntu.com/security/CVE-2026-40011
cve.org/CVERecord?id=CVE-2026-40011