PowerDNS DNSdist Denial-of-Service Vulnerability via DoQ or DoH3 Connections

A denial-of-service vulnerability has been identified in PowerDNS DNSdist versions through 2.0.3 and 1.9.12. The issue arises when an attacker creates a large number of concurrent DoQ or DoH3 connections, leading to unlimited memory allocation and causing the application to become unresponsive. Although DoQ and DoH3 are disabled by default, this vulnerability can still be exploited if these protocols are enabled.

Impact

Exploitation of this vulnerability causes excessive memory usage, leading to a denial-of-service condition where the application becomes unresponsive.

Remediation

Users can upgrade to PowerDNS DNSdist versions 1.9.13 or 2.0.4, where this vulnerability has been patched. Alternatively, DoQ and DoH3 can be disabled.