PowerDNS DNSdist TCP Backend Stream ID Overflow Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in PowerDNS DNSdist versions through 2.0.3 and 1.9.12. This issue arises when a client sends a flood of perfectly timed queries to a TCP-only or DNS over TLS backend, causing a mismatch between the queries sent and the responses received. As a result, the server may become overwhelmed, leading to service disruption.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by creating a mismatch between sent queries and received responses, potentially overwhelming the server.

Remediation

Users can upgrade to PowerDNS DNSdist versions 1.9.13 or 2.0.4, where this vulnerability has been patched. Alternatively, do not route queries to TCP-only or DNS over TLS backends.