CVE-2026-40208: DoH3 Denial of Service Vulnerability

CVE-2026-40208 Overview

CVE-2026-40208 affects PowerDNS DNSdist, a DNS load balancer that supports DNS-over-HTTPS version 3 (DoH3). An attacker can delay the processing of DoH3 queries by sending DoH3 GET requests that contain an invalid DATA frame. The flaw produces a limited availability impact and does not affect confidentiality or integrity. Exploitation requires high attack complexity and no authentication or user interaction.

Critical Impact
Remote attackers can introduce processing delays in DoH3 query handling, degrading DNS resolution performance for clients relying on the affected DNSdist instance.

Affected Products

PowerDNS DNSdist (DoH3-enabled builds)
DNS-over-HTTPS/3 (DoH3) query processing component
See the DNSdist Security Advisory for affected version ranges

Discovery Timeline

2026-06-25 - CVE-2026-40208 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-40208

Vulnerability Analysis

The vulnerability resides in how DNSdist parses DoH3 GET requests. DoH3 transports DNS queries over HTTP/3, which runs on QUIC. While GET-based DoH requests typically carry the DNS query in the URL parameter, the HTTP/3 framing layer still allows DATA frames within a request stream. DNSdist does not handle malformed DATA frames in GET requests efficiently, causing query processing to stall.

The issue is classified as a Denial of Service condition, specifically a processing delay rather than a crash or resource exhaustion. The attacker sends crafted DoH3 GET requests containing invalid DATA frames, and the server consumes additional processing time before either rejecting or continuing handling of the query. Refer to the DNSdist Security Advisory for vendor-confirmed technical detail.

Root Cause

The root cause is improper handling of unexpected DATA frames in HTTP/3 GET requests within the DoH3 handler. The protocol parser does not promptly reject or skip invalid frame structures, leading to delayed query processing.

Attack Vector

The attack vector is network-based. An attacker establishes a QUIC connection to the DoH3 listener and issues GET requests containing malformed DATA frames. No credentials and no user interaction are required. The high attack complexity reflects the need to craft valid HTTP/3 framing while embedding an invalid DATA frame that triggers the slow path.

No verified public exploit or proof-of-concept code is available. The vulnerability is described in prose because verified exploit code has not been published. See the vendor advisory for protocol-level specifics.

Detection Methods for CVE-2026-40208

Indicators of Compromise

Elevated DoH3 query latency or timeouts on DNSdist instances exposing HTTP/3 endpoints.
Anomalous volume of HTTP/3 GET requests from a small set of source addresses to the DoH3 listener.
DNSdist process consuming higher-than-baseline CPU while serving DoH3 traffic without a corresponding increase in successful query throughput.

Detection Strategies

Monitor DNSdist query latency metrics and compare DoH3 percentile latencies (p95, p99) against historical baselines.
Inspect HTTP/3 stream logs for GET requests that include unexpected DATA frames or abnormal frame sequences.
Correlate QUIC connection patterns with backend resolver latency to identify upstream impact from delayed DoH3 processing.

Monitoring Recommendations

Enable DNSdist statistics endpoints and export them to a metrics platform for alerting on latency and queue-depth anomalies.
Capture QUIC/HTTP/3 traffic samples at the network edge to support post-incident analysis when latency spikes occur.
Track per-source-IP DoH3 request rates and alert on sustained traffic patterns from unauthenticated clients.

How to Mitigate CVE-2026-40208

Immediate Actions Required

Apply the fixed DNSdist release documented in the DNSdist Security Advisory.
Inventory all DNSdist deployments and confirm whether DoH3 listeners are enabled and exposed to untrusted networks.
Restrict DoH3 listener exposure to known client networks where operationally feasible.

Patch Information

PowerDNS has published a fixed release as documented in the vendor advisory. Operators should upgrade DNSdist to the patched version identified in PowerDNS Advisory dnsdist-2026-09. Confirm the running version after upgrade using dnsdist --version and validate that DoH3 functionality continues to operate as expected.

Workarounds

Disable the DoH3 listener if DoH3 is not required for service delivery; continue serving DoH over HTTP/2 or DoT instead.
Place a rate-limiting reverse proxy or QUIC-aware load balancer in front of DNSdist to throttle suspicious HTTP/3 request patterns.
Apply per-source connection and request limits in DNSdist configuration to reduce the impact of malformed-request flooding.

bash

# Configuration example: disable DoH3 listener as a temporary workaround
# Remove or comment out the addDOH3Local() directive in dnsdist.conf
# addDOH3Local("0.0.0.0:443", "/etc/dnsdist/server.crt", "/etc/dnsdist/server.key")

# Verify running version after upgrade
dnsdist --version