CVE-2026-24030
Received Received - Intake
Memory Exhaustion in DNSdist via DNS over QUIC/HTTP3 Payloads

Publication date: 2026-03-31

Last updated on: 2026-04-14

Assigner: Open-Xchange

Description
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-31
Last Modified
2026-04-14
Generated
2026-06-16
AI Q&A
2026-03-31
EPSS Evaluated
2026-06-15
NVD
CVE-2026-24030
EUVD
EUVD-2026-17405
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
powerdns dnsdist From 1.9.0 (inc) to 1.9.12 (exc)
powerdns dnsdist From 2.0.0 (inc) to 2.0.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS). An attacker exploiting this issue can cause DNSdist to consume excessive memory, potentially leading to the termination of the DNSdist process or disruption of DNS services.

Executive Summary

This vulnerability involves DNSdist, where an attacker can trick it into allocating excessive memory while processing DNS over QUIC or DNS over HTTP/3 payloads. This excessive memory allocation can lead to a denial of service condition.

In environments with large amounts of memory, this usually causes an exception and the QUIC connection is closed properly. However, in some cases, the system may run out of memory and terminate the DNSdist process.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart