PowerDNS DNSdist up to 1.9.14/2.0.6 Prometheus Endpoint causing escape output

Summaryinfo

A vulnerability marked as problematic has been reported in PowerDNS DNSdist up to 1.9.14/2.0.6. This issue affects some unknown processing of the component Prometheus Endpoint. Performing a manipulation of the argument causing results in escape output. This vulnerability is cataloged as CVE-2026-40011. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in PowerDNS DNSdist up to 1.9.14/2.0.6. It has been classified as problematic. This affects an unknown code of the component Prometheus Endpoint. The manipulation of the argument causing with an unknown input leads to a escape output vulnerability. CWE is classifying the issue as CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. This is going to have an impact on integrity. The summary by CVE is:

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

The weakness was shared by Haruki Oyama. It is possible to read the advisory at dnsdist.org. This vulnerability is uniquely identified as CVE-2026-40011 since 04/08/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.9.15 or 2.0.7 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Domain Name Software

Vendor

• PowerDNS

Name

• DNSdist

Version

• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.9.9
• 1.9.10
• 1.9.11
• 1.9.12
• 1.9.13
• 1.9.14
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion