CVE-2026-24030
Powerdns Dnsdist 1.9.0 – 1.9.12
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2026-24030 is a medium-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Powerdns Dnsdist. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-6 (Resource Availability) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24030 affects DNSdist, a DNS load balancer and proxy software. The vulnerability enables an attacker to trick DNSdist into allocating excessive memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. This is classified as CWE-789 (Uncontrolled Memory Allocation) with a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). The issue was published on 2026-03-31.
An unauthenticated attacker with network access to a vulnerable DNSdist instance can exploit this by sending malicious payloads over DNS over QUIC or HTTP/3. Exploitation typically triggers an exception that closes the QUIC connection in systems with sufficient memory, but in some cases, it leads to a system-wide out-of-memory state that terminates the DNSdist process, causing a denial of service.
The PowerDNS security advisory for dnsdist-2026-02 at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html provides further details on mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17405
Vulnerability Data
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually…
more
results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly rejects or bounds untrusted size values before any allocation occurs.
Resource quotas and priority allocation limit the system-wide impact of an oversized request.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding flaws that trust unvalidated size values for allocations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect and block excessive allocation flaws before deployment.
Secure development lifecycle includes input validation and size checks that prevent unbounded allocations.
Application security requirements mandate bounds checking on size parameters to avoid excessive memory allocation.
Secure architecture principles require resource-limit enforcement that mitigates uncontrolled memory requests.
Secure coding standards directly prohibit allocating memory from untrusted size values without validation.
Capacity management monitors overall resource use but does not prevent individual allocation bugs.