CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections
Published Apr 22, 2026
·Updated
An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.
Affected Software
3 affected components
PowerDNS DNSDist
PowerDNS DNSDist>=1.9.0<1.9.13
PowerDNS DNSDist>=2.0.0<2.0.4
Event History
Apr 22, 2026
CVE Published
via MITRE·01:45 PM
Data Sourced
via MITRE·01:45 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33254?
CVE-2026-33254 has a high severity rating due to its potential for resource exhaustion leading to a denial of service.
2
How do I fix CVE-2026-33254?
To mitigate CVE-2026-33254, disable DoQ and DoH3 connections in your configuration as they are disabled by default.
3
What types of connections are exploited in CVE-2026-33254?
CVE-2026-33254 exploits a large number of concurrent DoQ and DoH3 connections to cause resource exhaustion.
4
Which software is affected by CVE-2026-33254?
CVE-2026-33254 affects the PowerDNS dnsdist application.
5
What happens if CVE-2026-33254 is exploited?
If exploited, CVE-2026-33254 can lead to unlimited memory allocation, resulting in a denial of service.