PowerDNS DNSdist Excessive Memory Allocation Vulnerability via DoQ and DoH3 Connections

A vulnerability in PowerDNS DNSdist versions prior to 1.9.13 and 2.0.4 allows clients to cause excessive memory allocation by generating numerous error responses over a single DoQ or DoH3 connection. This issue arises because certain resources are not properly released until the connection ends, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes unlimited memory allocation, leading to a denial-of-service condition where the application may become unresponsive or crash.

Remediation

Users can upgrade to PowerDNS DNSdist versions 1.9.13 or 2.0.4, or disable DoQ and DoH3, which are disabled by default.