CVE-2026-40011

LOW 3.7

Prometheus denial of service via crafted DNS queries

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

Vendor	powerdns
Product	dnsdist
Published	Jun 25, 2026
Last Updated	Jun 25, 2026

Stay Ahead of the Next One

Get instant alerts for powerdns dnsdist

Be the first to know when new low vulnerabilities affecting powerdns dnsdist are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

PowerDNS / DNSdist

1.9.0 < 1.9.15 2.0.0 < 2.0.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

dnsdist.org: https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html

Credits

Haruki Oyama (Waseda University)