{"id":"CVE-2026-40211","aliases":["DEBIAN-CVE-2026-40211","EUVD-2026-39350","GHSA-8mqg-g8g6-fvw6","SUSE-SU-2026:23123-1","SUSE-SU-2026:23146-1","UBUNTU-CVE-2026-40211","openSUSE-SU-2026:11411-1","openSUSE-SU-2026:21533-1"],"status":"published","title":"Denial of service via crafted DoH3 queries","description":"An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.007,"percentile":0.53443,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-06-25T12:23:55Z","modified":"2026-10-28T11:13:09Z","fixes":[{"ecosystem":"Debian:13","package":"dnsdist","fixed_in":["1.9.15-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dnsdist","fixed_in":["2.1.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.3-2","1.8.0-1","1.8.1-1","1.8.2-1","1.8.2-2","1.8.2-3","1.8.3-1","1.8.3-2","1.8.3-3","1.9.10-1","1.9.3-1","1.9.4-1","1.9.5-1","1.9.6-1","1.9.8-1","1.9.9-1","2.0.0-1","2.0.0-2","2.0.0-3","2.0.0-4","2.0.0-5","2.0.0-6","2.0.0~rc1-1","2.0.0~rc1-2","2.0.0~rc2-1","2.0.1-1","2.0.2-1","2.0.3-1","2.0.4-1","2.0.5-1","2.0.5-2","2.0.5-3","2.0.6-1","2.1.0-1","2.1.0-2","2.1.1-1","2.1.2-1","2.1.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-0+deb13u1"}]}],"versions":["1.9.10-1","1.9.10-1+deb13u1","1.9.14-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1"}]}],"versions":["1.9.10-1","2.0.0-1","2.0.0-2","2.0.0-3","2.0.0-4","2.0.0-5","2.0.0-6","2.0.0~rc1-1","2.0.0~rc1-2","2.0.0~rc2-1","2.0.1-1","2.0.2-1","2.0.3-1","2.0.4-1","2.0.5-1","2.0.5-2","2.0.5-3","2.0.6-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0~alpha2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-1","1.2.0-3","1.2.1-1","1.2.1-1build1","1.2.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0~rc3-1","1.4.0-1","1.4.0-1build1","1.4.0-1build2","1.4.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-3build2","1.6.1-1build1","1.6.1-1ubuntu0.1~esm1","1.6.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-1","1.8.2-1","1.8.2-2","1.8.2-3","1.8.3-1","1.8.3-2","1.8.3-2build1","1.8.3-2build2","1.8.3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.8-1","1.9.10-1","1.9.10-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2-1build1","2.0.5-2ubuntu1","2.0.5-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.10-1","2.0.1-1","2.0.2-1","2.0.2-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-160000.1.1"}]}],"bundled":7}],"products":[{"vendor":"powerdns","product":"dnsdist"}],"references":[{"url":"https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40211","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8mqg-g8g6-fvw6"},{"url":"https://repo.powerdns.com/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40211.json","tags":["advisory"]},{"url":"https://github.com/PowerDNS/pdns","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40211","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623123-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269201","tags":["report"]},{"url":"https://bugzilla.suse.com/1269202","tags":["report"]},{"url":"https://bugzilla.suse.com/1269203","tags":["report"]},{"url":"https://bugzilla.suse.com/1269204","tags":["report"]},{"url":"https://bugzilla.suse.com/1269205","tags":["report"]},{"url":"https://bugzilla.suse.com/1269206","tags":["report"]},{"url":"https://bugzilla.suse.com/1269207","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42005","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623146-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40211","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40211","tags":["report"]},{"url":"https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html#cve-2026-40211-denial-of-service-via-crafted-doh3-queries","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40211","title":"Denial of service via crafted DoH3 queries","description":"An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.","status":"published","published":"2026-06-25T12:23:55.585Z","modified":"2026-06-25T13:45:02.43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-39350","description":"An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.","status":"published","published":"2026-06-25T12:23:55Z","modified":"2026-06-25T13:45:02Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:29.213001Z"}],"ghsa":[{"id":"GHSA-8mqg-g8g6-fvw6","title":"An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some...","description":"An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.","status":"published","published":"2026-06-25T15:31:59Z","modified":"2026-06-25T15:32:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:08:58.724463Z"}],"nvd":[{"id":"CVE-2026-40211","description":"An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.","status":"published","published":"2026-06-25T13:16:39.717Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:26.045561Z"}],"osv":[{"id":"CVE-2026-40211","title":"Denial of service via crafted DoH3 queries","description":"An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.","status":"published","published":"2026-06-25T12:23:55.585Z","modified":"2026-10-28T11:13:09.169255758Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-40211","description":"An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.","status":"published","published":"2026-06-25T13:16:39.717Z","modified":"2026-10-26T12:02:57.404086139Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-40211","description":"An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.","status":"published","published":"2026-06-25T13:16:00Z","modified":"2026-10-17T12:58:53.965243178Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"openSUSE-SU-2026:11411-1","title":"dnsdist-2.0.7-1.1 on GA media","description":"These are all security issues fixed in the dnsdist-2.0.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-31T00:00:00Z","modified":"2026-08-01T09:45:06.06000202Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21533-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\nUpdate to 1.9.15.\n\nChanges for dnsdist:\n\n- https://www.dnsdist.org/changelog.html#change-1.9.15\n- https://www.dnsdist.org/changelog.html#change-1.9.14\n\nSecurity issues fixed:\n\n- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent\n  (bsc#1269204).\n- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames\n  (bsc#1269207).\n- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR\n  queries are sent (bsc#1269206).\n- CVE-2026-40210: out-of-bounds read when `SetMacAddrAction` is used can lead to uninitialized memory being sent over\n  the network or a crash (bsc#1269205).\n- CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can\n  lead to an OOM condition (bsc#1269203).\n- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT\n  record when EDNS Client Subnet is inserted (bsc#1269202).\n- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS\n  (bsc#1269201).\n","status":"published","published":"2026-08-05T09:13:07Z","modified":"2026-08-06T18:23:57.734710349Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23123-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\nUpdate to 1.9.15.\n\nChanges for dnsdist:\n\n- https://www.dnsdist.org/changelog.html#change-1.9.15\n- https://www.dnsdist.org/changelog.html#change-1.9.14\n\nSecurity issues fixed:\n\n- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent\n  (bsc#1269204).\n- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames\n  (bsc#1269207).\n- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR\n  queries are sent (bsc#1269206).\n- CVE-2026-40210: out-of-bounds read when `SetMacAddrAction` is used can lead to uninitialized memory being sent over\n  the network or a crash (bsc#1269205).\n- CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can\n  lead to an OOM condition (bsc#1269203).\n- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT\n  record when EDNS Client Subnet is inserted (bsc#1269202).\n- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS\n  (bsc#1269201).\n","status":"published","published":"2026-08-05T09:14:01Z","modified":"2026-08-14T18:23:39.882232948Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23146-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\nUpdate to 1.9.15.\n\nChanges for dnsdist:\n\n- https://www.dnsdist.org/changelog.html#change-1.9.15\n- https://www.dnsdist.org/changelog.html#change-1.9.14\n\nSecurity issues fixed:\n\n- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent\n  (bsc#1269204).\n- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames\n  (bsc#1269207).\n- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR\n  queries are sent (bsc#1269206).\n- CVE-2026-40210: out-of-bounds read when `SetMacAddrAction` is used can lead to uninitialized memory being sent over\n  the network or a crash (bsc#1269205).\n- CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can\n  lead to an OOM condition (bsc#1269203).\n- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT\n  record when EDNS Client Subnet is inserted (bsc#1269202).\n- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS\n  (bsc#1269201).\n","status":"published","published":"2026-08-05T09:14:01Z","modified":"2026-08-14T18:23:41.283401919Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}