PowerDNS DNSdist up to 1.9.14/2.0.6 File Descriptor denial of service

Summaryinfo

A vulnerability was found in PowerDNS DNSdist up to 1.9.14/2.0.6. It has been declared as problematic. Affected is an unknown function of the component File Descriptor Handler. Executing a manipulation can lead to denial of service. The identification of this vulnerability is CVE-2026-40209. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in PowerDNS DNSdist up to 1.9.14/2.0.6. This vulnerability affects some unknown processing of the component File Descriptor Handler. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.

The weakness was shared by Qifan Zhang. The advisory is available at dnsdist.org. This vulnerability was named CVE-2026-40209 since 04/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 1.9.15 or 2.0.7 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Domain Name Software

Vendor

• PowerDNS

Name

• DNSdist

Version

• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.9.9
• 1.9.10
• 1.9.11
• 1.9.12
• 1.9.13
• 1.9.14
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion