CVE & CISA-KEV Catalog

CVE-2026-24030

MEDIUM
5.3
CVSS v3
NVD

Description

An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.

CWE-789

How to fix

Remediation Available
dnsdistDebian
Fixed in:1.9.14-0+deb13u1CVE-2026-24030
Fixed in:2.0.3-1CVE-2026-24030

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityNone
IntegrityNone
AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploit Intelligence

0.54%probability of exploitation in 30 days
41stpercentile

Moderate risk: more likely to be exploited than 41% of all known CVEs.

References

Vendor Advisory1
Embed a live status badge for CVE-2026-24030
CVE-2026-24030 severity badge

Markdown

[![CVE-2026-24030](https://tridentstack.com/cve/badge/CVE-2026-24030.svg)](https://tridentstack.com/cve/CVE-2026-24030)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-24030"><img src="https://tridentstack.com/cve/badge/CVE-2026-24030.svg" alt="CVE-2026-24030"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-04-14.