PT-2026-34436 · Powerdns · Dnsdist

CVE-2026-33254

·

Published

2026-04-22

·

Updated

2026-06-22

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions DNSdist (affected versions not specified)
Description An attacker can create a large number of concurrent DoQ (DNS over QUIC) or DoH3 (DNS over HTTP/3) connections, causing unlimited memory allocation and leading to a denial of service. DoQ and DoH3 are disabled by default.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, ensure that DoQ and DoH3 remain disabled.

Exploit

DoS

Allocation of Resources Without Limits

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-33254
OPENSUSE-SU-2026:10632-1
OPENSUSE-SU-2026:21015-1
SUSE-SU-2026:22319-1

Affected Products

Dnsdist