An attacker can send specially crafted DNS over QUIC or DNS over HTTP/3 payloads to DNSdist, causing the server to allocate an unbounded amount of memory. The resulting memory exhaustion may trigger an exception that closes the connection, but in environments with ample memory the process can be killed by the operating system or the system may enter an out‑of‑memory state, effectively taking the DNS service offline. The weakness is a classic unbounded memory allocation flaw (CWE‑789.)

The vulnerability affects the PowerDNS DNSdist load balancer for any versions that process DoQ (DNS over QUIC) or DoH3 (DNS over HTTP/3). No specific release numbers were supplied, so all installations that enable these protocols are considered at risk unless a patched version has been deployed.

The CVSS score of 5.3 places this in the medium threat range, while the EPSS of less than 1 % indicates a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The flaw is network‑based and does not require authentication; an attacker can launch it from any host that can reach the DNSdist instance over the relevant ports. Successful exploitation results in denial of service, either via a graceful disconnect or by terminating the DNSdist process, and could impact all clients behind the load balancer.