Improper Encoding or Escaping of Output in dnsdist - CVE-2026-40011
Published: June 25, 2026
Vulnerability identifier: #VU135336
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40011
CWE-ID: CWE-116
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass monitoring integrity.
The vulnerability exists due to improper output neutralization in the prometheus endpoint when processing crafted DNS queries that trigger dynamic block insertion via dynBlockRulesGroup():setSuffixMatchRule() or dynBlockRulesGroup():setSuffixMatchRuleFFI(). A remote attacker can send a large number of crafted DNS queries to bypass monitoring integrity.
The invalid output causes the prometheus endpoint to be rejected by the scraper until the dynamic block expires.
Affected software
dnsdist
Debian Linux
dnsdist (Debian package)
Debian Linux
dnsdist (Debian package)
How to mitigate CVE-2026-40011
Install security update from vendor's website.
dnsdist - addressed in versions 1.9.15, 2.0.7
dnsdist (Debian package) - update to 1.9.15-0+deb13u1
dnsdist (Debian package) - update to 1.9.15-0+deb13u1