CVE-2026-40011: Powerdns Dnsdist

Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days.

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

Affected products

• Powerdns Dnsdist: from 1.9.0, before 1.9.15 (fixed in 1.9.15); from 2.0.0, before 2.0.7 (fixed in 2.0.7)

Published 2026-06-25. Last modified 2026-06-25.