CVE-2026-24030: 
NixOS vulnerability analysis and mitigation

CVE-2026-24030 is a denial-of-service vulnerability in PowerDNS DNSdist caused by uncontrolled memory allocation when processing DNS over QUIC (DoQ) or DNS over HTTP/3 (DoH3) payloads. An unauthenticated remote attacker can craft malicious payloads to trick DNSdist into allocating excessive memory, potentially causing process termination. Affected versions include DNSdist 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2. The vulnerability was disclosed on March 31, 2026. NIST NVD assigns a CVSS v3.1 base score of 7.5 (High), while the CNA (Open-Xchange) rates it 5.3 (Medium) (GitHub Advisory, PowerDNS Advisory).

The root cause is classified as CWE-789 (Memory Allocation with Excessive Size Value) and CWE-770 (Allocation of Resources Without Limits or Throttling), where DNSdist fails to enforce upper bounds on memory allocation when parsing DoQ or DoH3 payloads (GitHub Advisory). The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity — an attacker simply sends specially crafted DNS-over-QUIC or DNS-over-HTTP/3 packets to a listening DNSdist instance. In memory-rich environments, the process typically raises an exception and closes the QUIC connection gracefully; however, on systems with constrained memory, the OS may enter an out-of-memory (OOM) state and terminate the DNSdist process entirely (PowerDNS Advisory). No public proof-of-concept code has been identified.

Successful exploitation results in a denial-of-service condition affecting the availability of the DNSdist process. In the best case, an exception is raised and the QUIC connection is closed without broader service disruption; in the worst case, the system enters an out-of-memory state and the DNSdist process is terminated, interrupting DNS resolution for all clients relying on the affected instance (PowerDNS Advisory). There is no impact on confidentiality or integrity. The vulnerability only affects deployments with DoQ or DoH3 enabled.

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of reporting (GitHub Advisory). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability is detectable by Nessus (plugin IDs 304468, 310228) and Qualys (detection ID 6275353) (Feedly).

1. Reconnaissance: Identify internet-facing DNSdist instances running versions 1.9.0–1.9.11 or 2.0.0–2.0.2 with DNS over QUIC (UDP/853) or DNS over HTTP/3 (UDP/443 or custom port) enabled, using network scanning tools such as Shodan or Censys.
2. Craft malicious payload: Construct a DNS over QUIC or DNS over HTTP/3 payload designed to trigger excessive memory allocation — for example, by specifying an abnormally large content-length or oversized DNS message fields that DNSdist processes without enforcing size limits.
3. Send payload: Transmit the crafted QUIC or HTTP/3 packet(s) to the target DNSdist listener. No authentication or prior session establishment is required.
4. Trigger memory exhaustion: DNSdist attempts to allocate the requested memory. On memory-constrained systems, this causes the OS to invoke the OOM killer, terminating the DNSdist process and disrupting DNS resolution for all downstream clients (PowerDNS Advisory).

• Logs: Sudden DNSdist process crashes or restarts logged in system journals (journalctl -u dnsdist); OOM killer events in /var/log/kern.log or dmesg referencing the dnsdist process (e.g., Out of memory: Kill process <pid> (dnsdist)).
• Network: Unusual volume of DNS over QUIC (UDP/853) or DNS over HTTP/3 traffic from a single or small set of source IPs; large or malformed QUIC/HTTP3 frames directed at the DNSdist listener port.
• Process: Unexpected termination and restart of the dnsdist process; elevated memory consumption by the dnsdist process visible via top or ps prior to crash.
• System: Kernel OOM events correlating with spikes in QUIC/DoH3 traffic; system-level alerts for memory pressure on the DNSdist host.

Upgrade DNSdist to version 1.9.12 or 2.0.3, which contain fixes for this vulnerability (PowerDNS Advisory, PowerDNS Blog). If immediate patching is not possible, consider disabling DNS over QUIC and DNS over HTTP/3 listeners as a temporary workaround, or implement network-level access controls (e.g., firewall rules) to restrict which sources can send DoQ/DoH3 traffic to the DNSdist instance. Rate limiting on QUIC/HTTP3 connections at the network perimeter can also reduce exposure. Packages for Fedora, openSUSE, Debian, and FreeBSD have been updated to include the patched versions.

PowerDNS published a coordinated security advisory and release announcement on March 31, 2026, covering both the 1.9.12 and 2.0.3 releases (PowerDNS Blog). The vulnerability was also disclosed via the oss-security mailing list and tracked by Red Hat's Product Security team (Red Hat Bugzilla). Downstream Linux distributions including openSUSE, Fedora, Debian, and FreeBSD issued updated packages shortly after disclosure. Community reaction has been measured, consistent with a moderate-severity DoS vulnerability with no known active exploitation.