Allocation of Resources Without Limits or Throttling in dnsdist - CVE-2026-33594
Published: April 23, 2026
Vulnerability identifier: #VU126952
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33594
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in outgoing DoH handling when routing many queries to an overloaded DoH backend. A remote attacker can generate many queries that are routed to an overloaded DoH backend to cause a denial of service.
Queries accumulate in a buffer that is not released until the end of the connection.
Affected software
dnsdist
Debian Linux
Fedora
dnsdist (Debian package)
dnsdist
Debian Linux
Fedora
dnsdist (Debian package)
dnsdist
How to mitigate CVE-2026-33594
Install security update from vendor's website.
dnsdist - addressed in versions 1.9.13, 2.0.4
dnsdist (Debian package) - update to 1.9.14-0+deb13u1
dnsdist - update to 2.0.6-1.el10_2
dnsdist (Debian package) - update to 1.9.14-0+deb13u1
dnsdist - update to 2.0.6-1.el10_2