Denial of Service Vulnerability in PowerDNS by PowerDNS

CVE-2026-40211

What is CVE-2026-40211?

An attacker can exploit a flaw in PowerDNS by sending specially crafted DNS over HTTP/3 queries. This can trigger an exception that delays the freeing of buffers. While the buffer will eventually be released at the end of the QUIC connection, an attacker may be able to open multiple concurrent DoH3 streams, potentially leading to an out-of-memory condition. This condition could disrupt service availability, creating a denial of service scenario.

References