CVE-2026-33594: 
NixOS vulnerability analysis and mitigation

CVE-2026-33594 is a denial-of-service vulnerability in PowerDNS dnsdist caused by excessive memory allocation in the DNS-over-HTTPS (DoH) backend. An unauthenticated remote client can trigger unbounded memory growth by flooding an overloaded DoH backend with queries that accumulate in a buffer and are not released until the connection ends. Affected versions include dnsdist 1.9.0 through 1.9.12 and 2.0.0 through 2.0.3. It was disclosed on April 22, 2026, with a CVSS v3.1 base score of 7.5 (High) per NVD, or 5.3 (Moderate) per GitHub Advisory (GitHub Advisory, PowerDNS Blog).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): dnsdist does not impose restrictions on the number of pending queries buffered when routing to an overloaded DoH backend. When the backend is slow or saturated, incoming queries queue in memory without being released until the TCP/HTTP connection terminates, allowing an attacker to drive memory consumption arbitrarily high. No authentication or special privileges are required, and the attack complexity is low since any network-accessible client can initiate the condition (GitHub Advisory, PowerDNS Advisory).

Successful exploitation results in a denial-of-service condition through memory exhaustion on the dnsdist instance. There is no confidentiality or integrity impact — the vulnerability is limited to availability. An attacker who sustains the attack long enough can exhaust system memory, potentially crashing the dnsdist process or degrading DNS resolution service for all legitimate users relying on the affected DoH backend (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation as of the disclosure date (PowerDNS Blog). The EPSS score is approximately 0.01%, indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing dnsdist instances (versions 1.9.0–1.9.12 or 2.0.0–2.0.3) configured with a DoH backend using tools such as Shodan or Censys, searching for DNS-over-HTTPS endpoints.
2. Establish connection: Open a persistent HTTPS connection to the target dnsdist DoH listener (typically port 443 or 8443).
3. Flood with queries: Continuously send a high volume of DNS queries over the DoH connection targeting a backend that is already overloaded or artificially saturated, preventing query processing.
4. Trigger buffer accumulation: Because the overloaded backend cannot process queries fast enough, dnsdist buffers them in memory without releasing them during the connection lifetime.
5. Exhaust memory: Sustain the flood to grow the buffer indefinitely, consuming available system memory until the dnsdist process degrades or crashes, causing a denial-of-service condition for legitimate users (GitHub Advisory, PowerDNS Advisory).

• Network: Sustained high-volume HTTPS/DoH connections from a single or small set of source IPs to the dnsdist DoH listener port; unusually long-lived DoH connections with continuous query streams.
• System Resources: Rapid, sustained growth in dnsdist process memory (RSS) without corresponding increase in legitimate query load; system memory exhaustion alerts.
• Logs: dnsdist logs showing a large number of queued or pending outgoing DoH queries associated with a single connection; backend timeout or overload messages coinciding with memory growth.
• Process: dnsdist process consuming abnormally high memory as reported by tools such as top, htop, or system monitoring agents; potential OOM-killer events in kernel logs (dmesg) targeting the dnsdist process.

Upgrade dnsdist to version 1.9.13 or later (for the 1.9.x branch) or 2.0.4 or later (for the 2.0.x branch), which contain the fix for this vulnerability (PowerDNS Advisory, GitHub Advisory). As interim mitigations, implement rate limiting on DoH connections and queries per client at the network or application layer, and configure connection limits to restrict the number of concurrent DoH connections from individual clients. Monitor memory usage on dnsdist instances and set alerts for abnormal consumption patterns. Debian and openSUSE have also issued updated packages for their distributions (Linux Security).

PowerDNS published a security advisory and blog post on April 22, 2026, disclosing the vulnerability and providing patched versions (PowerDNS Blog). Red Hat tracked the issue via Bugzilla and assessed it as high severity (Red Hat Bugzilla). Debian and openSUSE subsequently issued distribution-level security updates. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking.