CVE-2026-40208
Denial of service via DoH3 queries
3.7 LowFix available
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
0.40%Up 0.1 points since Jun 26, 2026
What each source reports
CVE List Score used
Denial of service via DoH3 queries
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
- Record
CVE-2026-40208- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-705
- Updated
- 2026-11-02
EUVDEUVD-2026-39347
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
- Record
EUVD-2026-39347- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2cpw-vgr2-pw3h
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries...
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
- Record
GHSA-2cpw-vgr2-pw3h- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-705
- Updated
- 2026-11-02
NVD
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
- Record
CVE-2026-40208- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-705
- Updated
- 2026-11-02
OSV
Denial of service via DoH3 queries
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
- Record
CVE-2026-40208- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40208
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
- Record
DEBIAN-CVE-2026-40208- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2026-40208
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
- Record
UBUNTU-CVE-2026-40208- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11411-1 No score
dnsdist-2.0.7-1.1 on GA media
These are all security issues fixed in the dnsdist-2.0.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11411-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21533-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
openSUSE-SU-2026:21533-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23123-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
SUSE-SU-2026:23123-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23146-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
Update to 1.9.15.
Changes for dnsdist:
- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14
Security issues fixed:
- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when
SetMacAddrActionis used can lead to uninitialized memory being sent over the network or a crash (bsc#1269205). - CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS (bsc#1269201).
- Record
SUSE-SU-2026:23146-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsdistDebian:12 |
All versions, plus listed versions 1.7.3-21.8.0-11.8.1-11.8.2-11.8.2-2 Show 33 moreShow less1.8.2-31.8.3-11.8.3-21.8.3-31.9.10-11.9.3-11.9.4-11.9.5-11.9.6-11.9.8-11.9.9-12.0.0-12.0.0-22.0.0-32.0.0-42.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-12.1.0-12.1.0-22.1.1-12.1.2-12.1.3-1 |
None known |
dnsdistDebian:13 |
before 1.9.15-0+deb13u1, plus listed versions 1.9.10-11.9.10-1+deb13u11.9.14-0+deb13u1 |
1.9.15-0+deb13u1 |
dnsdistDebian:14 |
before 2.1.0-1, plus listed versions 1.9.10-12.0.0-12.0.0-22.0.0-32.0.0-4 Show 13 moreShow less2.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-1 |
2.1.0-1 |
dnsdistSUSE:Linux Enterprise Server 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
dnsdistSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
dnsdistUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.0~alpha2-1 |
None known |
dnsdistUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1 |
None known |
dnsdistUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.0~rc3-11.4.0-11.4.0-1build11.4.0-1build21.4.0-1ubuntu0.1~esm1 |
None known |
dnsdistUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.5.1-3build21.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2 |
None known |
dnsdistUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.8.0-11.8.2-11.8.2-21.8.2-31.8.3-1 Show 4 moreShow less1.8.3-21.8.3-2build11.8.3-2build21.8.3-2ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dnsdistUbuntu:25.10 |
All versions, plus listed versions 1.9.8-11.9.10-11.9.10-1ubuntu0.1 |
None known |
dnsdistUbuntu:26.10 |
All versions, plus listed versions 2.0.2-1build12.0.5-2ubuntu12.0.5-2ubuntu3 |
None known |
dnsdistUbuntu:26.04:LTS |
All versions, plus listed versions 1.9.10-12.0.1-12.0.2-12.0.2-1build1 |
None known |
dnsdistopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 2.0.7-1.1 | 2.0.7-1.1 |
dnsdistopenSUSE:Leap 16.0 From an advisory covering 7 CVEs |
before 1.9.15-160000.1.1 | 1.9.15-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40208 is a low vulnerability (CVSS 3.7) in Powerdns Dnsdist, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in dnsdist 1.9.15-0+deb13u1.
References
dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html
nvd.nist.gov/vuln/detail/CVE-2026-40208
github.com/advisories/GHSA-2cpw-vgr2-pw3h
repo.powerdns.com
Show 19 moreShow less
security-tracker.debian.org/tracker/CVE-2026-40208
suse.com/support/update/announcement/2026/suse-su-202623123-1
bugzilla.suse.com/1269201
ubuntu.com/security/CVE-2026-40208
cve.org/CVERecord?id=CVE-2026-40208