Skip to content
CVE PROGRAM SOURCE RECORD3.7 Low

CVE-2026-40011

Prometheus denial of service via crafted DNS queries

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OX

Description

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PowerDNS DNSdist

Default version status: unaffected

  • 1.9.0 to < 1.9.15affected
  • 2.0.0 to < 2.0.7affected

References