CVE-2026-24030 (GCVE-0-2026-24030)

Vulnerability from cvelistv5 – Published: 2026-03-31 12:01 – Updated: 2026-03-31 13:14
VLAI
Title
Unbounded memory allocation for DoQ and DoH3
Summary
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • Uncontrolled Memory Allocation
  • CWE-789 - Memory Allocation with Excessive Size Value
Assigner
OX
References
Impacted products
Vendor Product Version
PowerDNS DNSdist Affected: 1.9.0 , < 1.9.12 (semver)
Affected: 2.0.0 , < 2.0.3 (semver)
Create a notification for this product.
Date Public
2026-03-30 22:00
Credits
XavLimSG
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24030",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T13:14:53.937284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-789",
                "description": "CWE-789 Memory Allocation with Excessive Size Value",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:14:57.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.powerdns.com/",
          "defaultStatus": "unaffected",
          "modules": [
            "Incoming DNS over QUIC",
            "Incoming DNS over HTTP/3"
          ],
          "packageName": "dnsdist",
          "product": "DNSdist",
          "programFiles": [
            "doq.cc",
            "doh3.cc"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "vendor": "PowerDNS",
          "versions": [
            {
              "lessThan": "1.9.12",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "XavLimSG"
        }
      ],
      "datePublic": "2026-03-30T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.\u003c/p\u003e"
            }
          ],
          "value": "An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Uncontrolled Memory Allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T12:01:00.883Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unbounded memory allocation for DoQ and DoH3",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2026-24030",
    "datePublished": "2026-03-31T12:01:00.883Z",
    "dateReserved": "2026-01-20T14:56:25.872Z",
    "dateUpdated": "2026-03-31T13:14:57.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-24030",
      "date": "2026-07-31",
      "epss": "0.00537",
      "percentile": "0.42197"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-24030\",\"sourceIdentifier\":\"security@open-xchange.com\",\"published\":\"2026-03-31T12:16:27.770\",\"lastModified\":\"2026-07-25T10:10:00.167\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.\"},{\"lang\":\"es\",\"value\":\"Un atacante podr\u00eda enga\u00f1ar a DNSdist para que asigne demasiada memoria mientras procesa cargas \u00fatiles de DNS sobre QUIC o DNS sobre HTTP/3, lo que resultar\u00eda en una denegaci\u00f3n de servicio. En configuraciones con una gran cantidad de memoria disponible, esto generalmente resulta en una excepci\u00f3n y la conexi\u00f3n QUIC se cierra correctamente, pero en algunos casos el sistema podr\u00eda entrar en un estado de falta de memoria en su lugar y terminar el proceso.\"}],\"affected\":[{\"source\":\"security@open-xchange.com\",\"affectedData\":[{\"vendor\":\"PowerDNS\",\"product\":\"DNSdist\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.powerdns.com/\",\"packageName\":\"dnsdist\",\"modules\":[\"Incoming DNS over QUIC\",\"Incoming DNS over HTTP/3\"],\"programFiles\":[\"doq.cc\",\"doh3.cc\"],\"repo\":\"https://github.com/PowerDNS/pdns\",\"versions\":[{\"version\":\"1.9.0\",\"lessThan\":\"1.9.12\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"2.0.0\",\"lessThan\":\"2.0.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@open-xchange.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-31T13:14:53.937284Z\",\"id\":\"CVE-2026-24030\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-789\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.9.0\",\"versionEndExcluding\":\"1.9.12\",\"matchCriteriaId\":\"628B3B94-81DE-496E-B36A-B79A3DFFE1F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.0.3\",\"matchCriteriaId\":\"9AC850DD-FDD8-4C48-B861-4BBAF423FF57\"}]}]}],\"references\":[{\"url\":\"https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html\",\"source\":\"security@open-xchange.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-28T07:21:33+00:00",
      "cve": "CVE-2026-24030",
      "id": "CVE-2026-24030",
      "initial_release_date": "2026-03-31T12:01:00.883000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "DNSdist: DNSdist: Denial of Service via excessive memory allocation from DNS over QUIC or HTTP/3 payloads",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24030.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T05:27:22Z",
      "cve": "CVE-2026-24030",
      "id": "CVE-2026-24030",
      "initial_release_date": "2026-03-31T23:28:18Z",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "19",
      "product_status:recommended": "9",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-24030",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-24030.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-24030\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-31T13:14:53.937284Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-789\", \"description\": \"CWE-789 Memory Allocation with Excessive Size Value\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-31T13:14:48.598Z\"}}], \"cna\": {\"title\": \"Unbounded memory allocation for DoQ and DoH3\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"XavLimSG\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/PowerDNS/pdns\", \"vendor\": \"PowerDNS\", \"modules\": [\"Incoming DNS over QUIC\", \"Incoming DNS over HTTP/3\"], \"product\": \"DNSdist\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.9.0\", \"lessThan\": \"1.9.12\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.0.3\", \"versionType\": \"semver\"}], \"packageName\": \"dnsdist\", \"programFiles\": [\"doq.cc\", \"doh3.cc\"], \"collectionURL\": \"https://repo.powerdns.com/\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-03-30T22:00:00.000Z\", \"references\": [{\"url\": \"https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAn attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"Uncontrolled Memory Allocation\"}]}], \"providerMetadata\": {\"orgId\": \"8ce71d90-2354-404b-a86e-bec2cc4e6981\", \"shortName\": \"OX\", \"dateUpdated\": \"2026-03-31T12:01:00.883Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-24030\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-31T13:14:57.345Z\", \"dateReserved\": \"2026-01-20T14:56:25.872Z\", \"assignerOrgId\": \"8ce71d90-2354-404b-a86e-bec2cc4e6981\", \"datePublished\": \"2026-03-31T12:01:00.883Z\", \"assignerShortName\": \"OX\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.