CVE-2026-40208: DoH3 Denial of Service via Invalid DATA Frame

Technical summary

This vulnerability exploits improper handling of malformed DATA frames in DoH3 GET requests. DoH3 is an encrypted DNS protocol built on HTTP/3 (QUIC). When a server receives a DoH3 GET query with an invalid DATA frame, insufficient validation or error handling allows the request to delay query processing rather than being rejected promptly. The root cause maps to CWE-705 (Improper Control of Web Request before it is Sent to an Upstream Web Resource), suggesting the issue involves request parsing and forwarding logic. The attack is not trivial—it requires high complexity to execute successfully—but achieves a measurable availability impact.

Business impact

Organizations operating recursive DNS resolvers, authoritative nameservers, or DNS security appliances that support DoH3 may experience temporary query latency or throughput degradation during an attack. For enterprises relying on DoH3 for encrypted internal DNS traffic, a prolonged or distributed attack could degrade user experience or impact applications with strict DNS timeout requirements. However, the low CVSS score (3.7) reflects the difficulty and limited scope of exploitation. This is not a critical threat to most deployments but warrants monitoring in high-traffic DNS environments.

Affected systems

The vulnerability affects DoH3 server implementations that do not properly validate DATA frame format in GET requests. The provided source data does not list specific affected vendors or product versions; organizations should consult vendor security advisories and DoH3 protocol documentation to identify whether their DNS infrastructure (including edge caches, recursive resolvers, and DNS filtering solutions) includes DoH3 support. Products or appliances that recently added DoH3 capabilities are most likely to be impacted.

Exploitability

Exploitation requires network-level access to send crafted packets to a DoH3 endpoint, but authentication is not needed. However, the attack complexity is rated as high, meaning the attacker must navigate implementation-specific quirks or timing conditions to consistently trigger the delay. Automated exploitation tools are unlikely to emerge given the low severity and high complexity. This is not an attack vector that opportunistic threat actors would prioritize.

Remediation

Affected organizations should request updated DoH3 implementations from their vendors that include proper validation of DATA frame structure in GET requests. Until patches are available, network operators may implement rate limiting or request validation at the edge to reject malformed DoH3 frames. If DoH3 is not critical to your infrastructure, temporarily disabling it is a valid mitigation. Verify patch availability and applicability against your specific DNS platform.

Patch guidance

Contact your DNS platform vendor (recursive resolver provider, authoritative server provider, or DNS security appliance manufacturer) to determine DoH3 patch availability. The source data does not specify affected product versions or patch release numbers; vendor security advisories are the authoritative source. Prioritize patching for systems that handle high query volumes or support SLA-based DNS services, and test patches in a non-production environment given the protocol complexity. Standard change management procedures apply; this is not an emergency patch scenario.

Detection guidance

Monitor DNS query logs and DoH3 connection metrics for unusual patterns: sustained increases in query latency tied to specific client IPs, spikes in connection resets or timeouts, or elevated error rates on DoH3 endpoints. Network intrusion detection systems (IDS) may flag repeated sends of malformed HTTP/3 frames to DNS ports. Application Performance Monitoring (APM) tools on DNS resolvers should alert if per-query processing time climbs unexpectedly. Log analysis focusing on frame-parsing errors or protocol violations specific to DoH3 will help identify active exploitation attempts.

Why prioritize this

CVE-2026-40208 ranks as low priority for most organizations due to its low CVSS score, high attack complexity, and limited availability impact. It does not appear in CISA's KEV catalog, indicating no active exploitation in the wild as of the publication date. Prioritize this vulnerability only if your organization relies heavily on DoH3 for critical DNS operations or has experienced DoH3-specific performance issues. Otherwise, schedule patching in routine maintenance windows alongside other DNS infrastructure updates.

Risk score, explained

The CVSS 3.1 score of 3.7 reflects a low-risk rating driven by: (1) only availability is impacted (no confidentiality or integrity loss), (2) attack complexity is high, requiring specific conditions, (3) no privileges or user interaction are needed, and (4) the impact is temporary query delay rather than total outage. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L emphasizes that while an attacker can reach the service over the network, the attack is difficult to execute and effects are localized to availability.

Frequently asked questions