CVE-2026-33254: DNSdist DoS Vulnerability via DoQ/DoH3

CVE-2026-33254 Overview

CVE-2026-33254 is a denial of service vulnerability affecting DNSdist, a highly DNS-, DoS- and abuse-aware loadbalancer. An attacker can create a large number of concurrent DNS over QUIC (DoQ) or DNS over HTTP/3 (DoH3) connections, causing unlimited memory allocation in DNSdist and leading to a denial of service condition. While DoQ and DoH3 are disabled by default, environments that have enabled these features are at risk of service disruption through resource exhaustion attacks.

Critical Impact

Remote attackers can exhaust server memory by opening numerous concurrent DoQ or DoH3 connections, causing DNSdist to become unresponsive and disrupting DNS resolution services for legitimate users.

Affected Products

• DNSdist with DoQ (DNS over QUIC) enabled
• DNSdist with DoH3 (DNS over HTTP/3) enabled
• DNSdist deployments using QUIC-based protocols

Discovery Timeline

• April 22, 2026 - CVE-2026-33254 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33254

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw exists in how DNSdist handles concurrent connections for the newer QUIC-based DNS protocols. When DoQ or DoH3 are enabled, the application fails to properly limit the number of concurrent connections or the memory allocated for connection state management.

The network-accessible nature of this vulnerability means remote attackers can exploit it without requiring authentication or user interaction. Each new connection consumes memory resources that are not properly bounded, allowing an attacker to systematically exhaust available memory by initiating and maintaining a large number of concurrent connections.

Root Cause

The root cause of CVE-2026-33254 lies in the absence of proper resource allocation limits for DoQ and DoH3 connection handling in DNSdist. When these protocols are enabled, the server allocates memory for each incoming connection without enforcing maximum limits on the total number of concurrent connections or the aggregate memory consumption. This design flaw allows attackers to force unbounded memory allocation, eventually exhausting system resources.

Attack Vector

The attack vector is network-based, requiring no authentication or privileges. An attacker can exploit this vulnerability by:

1. Identifying a DNSdist instance with DoQ (typically port 853/UDP) or DoH3 enabled
2. Initiating a large number of QUIC connections to the target
3. Maintaining these connections in an open state to consume memory
4. Continuing to create new connections until memory is exhausted

The attack is particularly effective because QUIC's connection multiplexing and the stateful nature of these encrypted DNS protocols require the server to maintain per-connection state. Without proper limits, each connection contributes to progressive memory exhaustion until the service becomes unresponsive or crashes.

Detection Methods for CVE-2026-33254

Indicators of Compromise

• Unusual spike in memory consumption on DNSdist servers
• Abnormally high number of concurrent DoQ or DoH3 connections from single or distributed sources
• DNSdist process memory growth without corresponding increase in legitimate DNS traffic
• System out-of-memory (OOM) events or swap space exhaustion on DNS infrastructure

Detection Strategies

• Monitor DNSdist memory usage metrics and alert on rapid or sustained increases beyond baseline thresholds
• Implement connection rate monitoring for DoQ (UDP/853) and DoH3 endpoints to detect flood patterns
• Deploy network flow analysis to identify sources generating excessive QUIC connection attempts
• Configure SentinelOne to monitor for resource exhaustion patterns on DNSdist hosts

Monitoring Recommendations

• Establish baseline memory usage patterns for DNSdist under normal load conditions
• Configure alerting thresholds for connection counts and memory consumption on DoQ/DoH3 listeners
• Implement logging for connection establishment and termination events on QUIC-based protocols
• Use SentinelOne's behavioral AI to detect anomalous resource consumption patterns indicative of exploitation

How to Mitigate CVE-2026-33254

Immediate Actions Required

• Assess whether DoQ or DoH3 are enabled in your DNSdist deployment; if not required, disable these features
• Apply vendor patches as they become available from the DNSdist project
• Implement connection rate limiting at the network perimeter for QUIC traffic destined to DNSdist instances
• Configure operating system-level resource limits (cgroups, ulimits) to prevent DNSdist from consuming all available system memory

Patch Information

Refer to the official DNSDist Security Advisory 2026-04 for detailed patching instructions and affected version information. Organizations should prioritize upgrading to patched versions that implement proper connection and memory limits for DoQ and DoH3 protocols.

Workarounds

• Disable DoQ and DoH3 features if not operationally required, as these protocols are disabled by default
• Deploy rate limiting rules on upstream firewalls or load balancers to restrict QUIC connection rates
• Implement connection limits at the reverse proxy or load balancer layer if DoQ/DoH3 must remain enabled
• Use container resource limits or systemd memory caps to bound maximum memory consumption for DNSdist processes

# Example: Disable DoQ and DoH3 in DNSdist configuration
# Comment out or remove addDOQLocal() and addDOH3Local() directives
# Restart DNSdist after configuration changes

# Verify no DoQ/DoH3 listeners are active
dnsdist --check-config

# Example: Set memory limits using systemd override
# /etc/systemd/system/dnsdist.service.d/memory-limit.conf
# [Service]
# MemoryMax=2G
# MemoryHigh=1.5G