p PatchFirst

CVE-2026-24030

CVE-2026-24030 · Unbounded memory allocation for DoQ and DoH3

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dnsdist

    Versions
    • ≥ 1.9.0, < 1.9.12: Affected (semver)
    • ≥ 2.0.0, < 2.0.3: Affected (semver)

    Update to 1.9.12; Update to 2.0.3

  • dnsdist Debian:12

    Versions
    • 1.7.3-2
    • 1.8.0-1
    • 1.8.1-1
    • 1.8.2-1
    • 1.8.2-2
    • 1.8.2-3
    • 1.8.3-1
    • 1.8.3-2
    • 1.8.3-3
    • 1.9.10-1
    • 1.9.3-1
    • 1.9.4-1
    • 1.9.5-1
    • 1.9.6-1
    • 1.9.8-1
    • 1.9.9-1
    • 2.0.0-1
    • 2.0.0-2
    • 2.0.0-3
    • 2.0.0-4
    • 2.0.0-5
    • 2.0.0-6
    • 2.0.0~rc1-1
    • 2.0.0~rc1-2
    • 2.0.0~rc2-1
    • 2.0.1-1
    • 2.0.2-1
    • 2.0.3-1
    • 2.0.4-1
    • 2.0.5-1
    • 2.0.5-2
    • 2.0.5-3
    • 2.0.6-1
    • 2.1.0-1
    • 2.1.0-2
    • 2.1.1-1
    • 2.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Debian:13

    Versions
    • 1.9.10-1
    • 1.9.10-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 1.9.14-0+deb13u1

    Update to 1.9.14-0+deb13u1

  • dnsdist Debian:14

    Versions
    • 1.9.10-1
    • 2.0.0-1
    • 2.0.0-2
    • 2.0.0-3
    • 2.0.0-4
    • 2.0.0-5
    • 2.0.0-6
    • 2.0.0~rc1-1
    • 2.0.0~rc1-2
    • 2.0.0~rc2-1
    • 2.0.1-1
    • 2.0.2-1
    Affected ranges
    • ECOSYSTEM: < 2.0.3-1

    Update to 2.0.3-1

  • dnsdist Ubuntu:16.04:LTS

    Versions
    • 1.0.0~alpha2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:18.04:LTS

    Versions
    • 1.2.0-1
    • 1.2.0-3
    • 1.2.1-1
    • 1.2.1-1build1
    • 1.2.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:20.04:LTS

    Versions
    • 1.4.0~rc3-1
    • 1.4.0-1
    • 1.4.0-1build1
    • 1.4.0-1build2
    • 1.4.0-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:22.04:LTS

    Versions
    • 1.5.1-3build2
    • 1.6.1-1build1
    • 1.6.1-1ubuntu0.1~esm1
    • 1.6.1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:24.04:LTS

    Versions
    • 1.8.0-1
    • 1.8.2-1
    • 1.8.2-2
    • 1.8.2-3
    • 1.8.3-1
    • 1.8.3-2
    • 1.8.3-2build1
    • 1.8.3-2build2
    • 1.8.3-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:25.10

    Versions
    • 1.9.8-1
    • 1.9.10-1
    • 1.9.10-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:26.10

    Versions
    • 2.0.2-1build1
    • 2.0.5-2ubuntu1
    • 2.0.5-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:26.04:LTS

    Versions
    • 1.9.10-1
    • 2.0.1-1
    • 2.0.2-1
    • 2.0.2-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →