CVE-2026-40209

Published: Jun 25, 2026Modified: Jun 25, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: security@open-xchange.com (Secondary)

Description

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.

Related CWEs

CWE-772

Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

References (1)

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html

Source: security@open-xchange.com

Timeline

No history available yet.