An attacker can open a high volume of concurrent DoQ or DoH3 connections to a DNSdist instance. Because DoQ and DoH3 allow unlimited memory allocation per connection, the service can exhaust its available memory and become unresponsive. The vulnerability is classified as CWE-770, indicating a resource‑exhaustion weakness that leads to denial of service.

The flaw affects DNSdist, the open‑source load‑balancing front‑end for PowerDNS. Any installation that has DoQ or DoH3 enabled is susceptible; the advisory notes that these protocols are disabled by default.

The CVSS score of 5.3 places the issue in the medium severity range. EPSS is currently unavailable and the flaw is not listed in the CISA KEV catalog. Because DoQ and DoH3 are off by default, successful exploitation requires the attacker to either enable them or convince the operator to do so. If enabled, the path of attack is to generate a large number of simultaneous connections, which will drain the server’s memory and cause a denial of service.