CVE-2026-40208 Denial of service via DoH3 queries
An attacker can cause denial of service in PowerDNS DNSdist by sending malformed DoH3 GET queries with invalid DATA frames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40208?
CVE-2026-40208 is a low-severity denial of service vulnerability in PowerDNS DNSdist, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
Weakness: CWE-705
Which versions are affected by CVE-2026-40208?
How do I fix CVE-2026-40208?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-40208 being exploited?
There is no known exploitation of CVE-2026-40208 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-40208, GHSA-2cpw-vgr2-pw3h, UBUNTU-CVE-2026-40208.