PowerDNS DNSdist Outgoing DoH Excessive Memory Allocation Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in PowerDNS DNSdist versions 1.9.12 and prior to 2.0.4. This issue allows a client to cause excessive memory allocation by sending a large number of queries to an overloaded DoH backend. The accumulated queries create a buffer that remains filled until the connection is closed. This vulnerability can lead to resource exhaustion and potential service disruption.

Impact

Exploitation of this vulnerability causes unlimited memory allocation, leading to a denial-of-service condition where the service becomes unresponsive or unavailable.

Remediation

Users can upgrade to PowerDNS DNSdist versions 1.9.13 or 2.0.4, where this vulnerability has been fixed. Alternatively, outgoing DoH can be disabled to mitigate the issue.