CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections
An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/dnsdistto a version that resolves this vulnerability.Fixed in 2.0.4-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33254?
CVE-2026-33254 has a high severity rating due to its potential for resource exhaustion leading to a denial of service.
How do I fix CVE-2026-33254?
To mitigate CVE-2026-33254, disable DoQ and DoH3 connections in your configuration as they are disabled by default.
What types of connections are exploited in CVE-2026-33254?
CVE-2026-33254 exploits a large number of concurrent DoQ and DoH3 connections to cause resource exhaustion.
Which software is affected by CVE-2026-33254?
CVE-2026-33254 affects the PowerDNS dnsdist application.
What happens if CVE-2026-33254 is exploited?
If exploited, CVE-2026-33254 can lead to unlimited memory allocation, resulting in a denial of service.