Allocation of Resources Without Limits or Throttling in dnsdist - CVE-2026-33254
Published: April 23, 2026
Vulnerability identifier: #VU126945
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33254
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in DoQ and DoH3 connection handling when opening a large number of connections. A remote attacker can open a large number of DoQ or DoH3 connections to cause a denial of service.
DoQ and DoH3 are disabled by default.
Affected software
dnsdist
Debian Linux
Fedora
dnsdist (Debian package)
dnsdist
Debian Linux
Fedora
dnsdist (Debian package)
dnsdist
How to mitigate CVE-2026-33254
Install security update from vendor's website.
dnsdist - addressed in versions 1.9.13, 2.0.4
dnsdist (Debian package) - update to 1.9.14-0+deb13u1
dnsdist - update to 2.0.6-1.el10_2
dnsdist (Debian package) - update to 1.9.14-0+deb13u1
dnsdist - update to 2.0.6-1.el10_2