CVE-2026-24030: falha de média gravidade em PowerDNS DNSdist
Unbounded memory allocation for DoQ and DoH3
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.6%
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
PowerDNS · DNSdistCVEs relacionadas — PowerDNS DNSdist
No mesmo produto, das mais perigosas para as menos.
CVE-2025-30194HIGHDenial of service via crafted DoH exchangeEPSS 2.3%CVE-2024-25581HIGHTransfer requests received over DoH can lead to a denial of service in DNSdistEPSS 1.1%CVE-2026-33598MEDIUMOut-of-bounds read in cache inspection via LuaEPSS 1.1%CVE-2026-24028MEDIUMOut-of-bounds read when parsing DNS packets via LuaEPSS 1.1%CVE-2026-40210MEDIUMOut-of-bounds read in SetMacAddrActionEPSS 0.7%CVE-2026-33602MEDIUMOff-by-one access when processing crafted UDP responsesEPSS 0.7%