p PatchFirst

CVE-2026-40208

CVE-2026-40208 · Denial of service via DoH3 queries

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.

CVSS 3.7 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dnsdist

    Versions
    • ≥ 1.9.0, < 1.9.15: Affected (semver)
    • ≥ 2.0.0, < 2.0.7: Affected (semver)

    Update to 1.9.15; Update to 2.0.7

  • dnsdist Debian:12

    Versions
    • 1.7.3-2
    • 1.8.0-1
    • 1.8.1-1
    • 1.8.2-1
    • 1.8.2-2
    • 1.8.2-3
    • 1.8.3-1
    • 1.8.3-2
    • 1.8.3-3
    • 1.9.10-1
    • 1.9.3-1
    • 1.9.4-1
    • 1.9.5-1
    • 1.9.6-1
    • 1.9.8-1
    • 1.9.9-1
    • 2.0.0-1
    • 2.0.0-2
    • 2.0.0-3
    • 2.0.0-4
    • 2.0.0-5
    • 2.0.0-6
    • 2.0.0~rc1-1
    • 2.0.0~rc1-2
    • 2.0.0~rc2-1
    • 2.0.1-1
    • 2.0.2-1
    • 2.0.3-1
    • 2.0.4-1
    • 2.0.5-1
    • 2.0.5-2
    • 2.0.5-3
    • 2.0.6-1
    • 2.1.0-1
    • 2.1.0-2
    • 2.1.1-1
    • 2.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Debian:13

    Versions
    • 1.9.10-1
    • 1.9.10-1+deb13u1
    • 1.9.14-0+deb13u1
    Affected ranges
    • ECOSYSTEM: < 1.9.15-0+deb13u1

    Update to 1.9.15-0+deb13u1

  • dnsdist Debian:14

    Versions
    • 1.9.10-1
    • 2.0.0-1
    • 2.0.0-2
    • 2.0.0-3
    • 2.0.0-4
    • 2.0.0-5
    • 2.0.0-6
    • 2.0.0~rc1-1
    • 2.0.0~rc1-2
    • 2.0.0~rc2-1
    • 2.0.1-1
    • 2.0.2-1
    • 2.0.3-1
    • 2.0.4-1
    • 2.0.5-1
    • 2.0.5-2
    • 2.0.5-3
    • 2.0.6-1
    Affected ranges
    • ECOSYSTEM: < 2.1.0-1

    Update to 2.1.0-1

  • dnsdist Ubuntu:16.04:LTS

    Versions
    • 1.0.0~alpha2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:18.04:LTS

    Versions
    • 1.2.0-1
    • 1.2.0-3
    • 1.2.1-1
    • 1.2.1-1build1
    • 1.2.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:20.04:LTS

    Versions
    • 1.4.0~rc3-1
    • 1.4.0-1
    • 1.4.0-1build1
    • 1.4.0-1build2
    • 1.4.0-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:22.04:LTS

    Versions
    • 1.5.1-3build2
    • 1.6.1-1build1
    • 1.6.1-1ubuntu0.1~esm1
    • 1.6.1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:24.04:LTS

    Versions
    • 1.8.0-1
    • 1.8.2-1
    • 1.8.2-2
    • 1.8.2-3
    • 1.8.3-1
    • 1.8.3-2
    • 1.8.3-2build1
    • 1.8.3-2build2
    • 1.8.3-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:25.10

    Versions
    • 1.9.8-1
    • 1.9.10-1
    • 1.9.10-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:26.10

    Versions
    • 2.0.2-1build1
    • 2.0.5-2ubuntu1
    • 2.0.5-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:26.04:LTS

    Versions
    • 1.9.10-1
    • 2.0.1-1
    • 2.0.2-1
    • 2.0.2-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →