DNSdist, a DNS load balancer, contains a flaw that allows an attacker to trigger an unbounded memory allocation when processing DNS packets over QUIC or HTTP/3. The resulting excessive memory usage can exhaust system resources and cause the service to crash or enter an out‑of‑memory state. The weakness is classified as CWE‑789, which involves improper handling of memory allocation sizes.

The vulnerable component is DNSdist from PowerDNS. No specific product versions are listed in the advisory, so all deployed installations of DNSdist should be considered potentially affected until the vendor provides a precise version range.

The problem has a CVSS score of 5.3, indicating moderate severity. While a formal exploit probability metric is not provided, the vulnerability can be triggered remotely by carefully crafted DoQ or DoH3 traffic. If the target system has sufficient memory, the failure may be limited to an exception and packet rejection; however, in other configurations the allocation may bring the host down, resulting in a denial of service. The vulnerability is not listed in CISA's KEV catalog, but the potential impact warrants immediate attention.