CVE-2026-24030: Unbounded memory allocation for DoQ and DoH3
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24030?
CVE-2026-24030 is classified as a denial of service vulnerability due to unbounded memory allocation.
How do I fix CVE-2026-24030?
To fix CVE-2026-24030, update your PowerDNS DNSdist installation to the latest version that addresses this vulnerability.
What specific components of PowerDNS are affected by CVE-2026-24030?
CVE-2026-24030 affects the DNSdist component when processing DNS over QUIC and DNS over HTTP/3 payloads.
Can CVE-2026-24030 lead to system crashes or outages?
Yes, CVE-2026-24030 can result in denial of service, potentially leading to crashes or outages in DNS services.
Are there any known exploits for CVE-2026-24030?
As of now, there are no publicly disclosed exploits for CVE-2026-24030, but the vulnerability presents a risk if not mitigated.