CVE-2026-40211: DNS over HTTP/3 DoS Vulnerability

CVE-2026-40211 Overview

CVE-2026-40211 is a denial of service vulnerability affecting PowerDNS dnsdist when DNS over HTTP/3 (DoH3) is enabled. An attacker can send crafted DoH3 queries that trigger an exception during processing. The exception prevents an internal buffer from being freed immediately, deferring its release until the underlying QUIC connection terminates. By opening enough concurrent DoH3 streams, a remote unauthenticated attacker can exhaust available memory and cause service disruption.

Critical Impact
Remote unauthenticated attackers can exhaust dnsdist memory through concurrent DoH3 streams, producing an out-of-memory denial of service against DNS resolution infrastructure.

Affected Products

PowerDNS dnsdist with DNS over HTTP/3 (DoH3) listener enabled
See the DNSdist Security Advisory 2026-09 for affected versions
Deployments exposing DoH3 endpoints to untrusted clients

Discovery Timeline

2026-06-25 - CVE-2026-40211 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-40211

Vulnerability Analysis

The flaw resides in the DoH3 query handling path of dnsdist. When the parser encounters a malformed or unexpected DoH3 query, it raises an exception during processing. The exception path bypasses the normal cleanup routine that would release a query buffer allocated earlier in the request lifecycle. Memory associated with each failed stream remains allocated until the parent QUIC connection closes.

QUIC permits a single connection to multiplex many concurrent streams. An attacker who can maintain a long-lived QUIC connection and open many DoH3 streams within it accumulates leaked buffers. On installations with sufficient stream concurrency limits, this accumulation reaches an out-of-memory state and the dnsdist process becomes unresponsive or terminates.

Root Cause

The root cause is improper resource cleanup on an exceptional control-flow path. The buffer ownership is not transferred to a scope guard or RAII container that would deallocate it during exception unwinding. Cleanup is instead tied to connection teardown, decoupling buffer lifetime from stream lifetime.

Attack Vector

Exploitation requires only network access to a dnsdist DoH3 listener. No authentication, user interaction, or privileged position is needed. The attacker establishes a QUIC connection, opens DoH3 streams, and sends crafted queries that reliably trigger the exception path. The connection is held open while additional streams are issued, compounding the memory leak until the process exhausts its heap.

No verified proof-of-concept code is published with the advisory. Refer to the DNSdist Security Advisory 2026-09 for vendor-supplied technical details.

Detection Methods for CVE-2026-40211

Indicators of Compromise

Sustained growth in dnsdist resident memory without a corresponding increase in legitimate query volume
High counts of long-lived QUIC connections with many concurrent streams from a small number of source addresses
dnsdist log entries showing repeated DoH3 parsing exceptions or malformed query errors
Process restarts or OOM-killer events targeting dnsdist on hosts exposing UDP/443

Detection Strategies

Monitor dnsdist process memory and correlate spikes with DoH3 stream counts from showTCPStats() and DoH3-specific counters
Alert on anomalous ratios of DoH3 exceptions to successful queries per source IP
Inspect QUIC traffic for sources opening unusually high concurrent stream counts on a single connection

Monitoring Recommendations

Export dnsdist metrics (Prometheus or carbon) and track doh3- counters and per-frontend memory trends
Forward dnsdist logs to a centralized analytics platform and build identifications on repeated DoH3 parse failures
Set host-level OOM and process restart alerts on resolver nodes

How to Mitigate CVE-2026-40211

Immediate Actions Required

Upgrade dnsdist to the fixed version identified in the DNSdist Security Advisory 2026-09
Audit which frontends expose DoH3 and restrict exposure to trusted networks where feasible
Apply per-source connection and stream rate limits at the network edge

Patch Information

PowerDNS has published a fix in the DNSdist Security Advisory 2026-09. Consult the advisory for the exact fixed release versions and upstream commit references, then upgrade affected nodes following standard dnsdist rolling-restart procedures.

Workarounds

Disable the DoH3 listener (addDOH3Local) until the patched version is deployed, falling back to DoH/2 or DoT
Lower the maximum concurrent streams permitted per QUIC connection on the DoH3 frontend
Place a QUIC-aware proxy or rate limiter in front of dnsdist to cap streams and connection duration per source
Constrain dnsdist memory with systemd MemoryMax= and configure automatic restart on OOM to limit outage duration

bash

# Example: disable DoH3 frontend in dnsdist.conf until patched
# Comment out or remove the DoH3 listener
-- addDOH3Local("0.0.0.0:443", "/etc/dnsdist/cert.pem", "/etc/dnsdist/key.pem")

# Example: cap process memory via systemd override
# /etc/systemd/system/dnsdist.service.d/override.conf
[Service]
MemoryMax=2G
Restart=on-failure
RestartSec=5s