CVE-2026-24030 Unbounded memory allocation for DoQ and DoH3

What is CVE-2026-24030?

CVE-2026-24030 is a medium-severity denial of service vulnerability in PowerDNS DNSdist, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.

Weakness: CWE-789

Which versions are affected by CVE-2026-24030?

It affects 1 product.

Products include Powerdns Dnsdist.

How do I fix CVE-2026-24030?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-24030 being exploited?

There is no known exploitation of CVE-2026-24030 in the wild and no public exploit code.

Other vulnerabilities in PowerDNS DNSdist

• CVE-2017-7557 Cross-site request forgery in dnsdist High 8.8
• CVE-2026-33593 Denial of service via crafted DNSCrypt query High 7.5
• CVE-2026-33602 Off-by-one access when processing crafted UDP responses Medium 6.5
• CVE-2026-24029 DNS over HTTPS ACL bypass Medium 6.5
• CVE-2026-27853 Out-of-bounds write when rewriting large DNS packets Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-24030, GHSA-v2vv-6q75-rvc9, UBUNTU-CVE-2026-24030.