CVE-2026-40211: DNS over HTTP/3 Denial-of-Service via Crafted Queries

Technical summary

The vulnerability stems from improper buffer lifecycle management in DoH3 query processing. When a crafted DNS query arrives over HTTP/3, an exception is raised that bypasses normal cleanup routines, causing the associated buffer to persist until the underlying QUIC connection terminates rather than being freed immediately after the query is handled. On systems handling high volumes of concurrent connections—particularly those exposed to the public internet—an attacker can rapidly establish many QUIC streams, each with a crafted query that triggers the exception. This accumulation of unreleased buffers can exhaust heap memory, leading to out-of-memory conditions and service unavailability. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), reflecting the lack of resource constraint mechanisms.

Business impact

Organizations operating public-facing DoH3 resolvers or recursive DNS services are at risk of availability disruption. An attacker with minimal resources—only network access—can trigger repeated denials of service without sophisticated techniques or payload delivery. The impact is primarily availability-focused; there is no data breach, integrity violation, or privilege escalation. However, sustained DoH3 service degradation can degrade user experience for clients relying on that resolver, potentially affecting downstream authentication, email delivery, and web access for affected users. For internal corporate DNS services exposed to untrusted networks, the risk is similarly constrained to availability.

Affected systems

The source data does not specify particular DNS resolver implementations, operating systems, or versions. Organizations should consult their DoH3 implementation vendor or check for official advisories to determine which products and versions are affected. Common targets include publicly available recursive DNS resolvers and authoritative nameservers configured to accept DoH3 queries.

Exploitability

The vulnerability has a low barrier to exploitation. An attacker requires only network access (AV:N), no special configuration (AC:L), no credentials (PR:N), and no user interaction (UI:N). The attacker must be able to initiate QUIC connections to the target resolver and send HTTP/3 requests. The sustained nature of the attack—requiring many concurrent streams to trigger OOM—means it is not an instant one-shot exploit, but the technique is straightforward and does not require sophisticated tooling. The CVSS score of 5.3 (MEDIUM) reflects that availability impact alone, without confidentiality or integrity compromise, results in moderate overall risk.

Remediation

Patching is the primary remediation. Vendors should release updates that either (1) ensure buffers are freed immediately after exception handling, (2) implement per-connection or per-stream buffer limits, or (3) add connection-level rate limiting to prevent rapid stream creation. Until patches are available, network-level mitigations include rate limiting DoH3 connections per source IP, implementing connection timeouts, and monitoring memory usage on DNS resolver instances. Organizations should verify patch availability from their DNS software vendor before implementing workarounds.

Patch guidance

Check with your DNS resolver vendor for security advisories related to CVE-2026-40211 and DoH3 memory handling. Patch availability, version numbers, and deployment instructions will vary by implementation. Test patches in a non-production environment first, particularly if your resolver handles high traffic. After patching, verify that DoH3 services are responsive and that memory usage patterns return to baseline under normal query loads.

Detection guidance

Monitor DNS resolver memory consumption in real-time, especially for processes handling QUIC/HTTP3 traffic. Set alerts for unexpected memory growth or out-of-memory events. Network telemetry showing a sudden spike in concurrent QUIC connections from a single source or small set of sources may indicate an active exploitation attempt. Log analysis should track the number of active DoH3 streams per connection; a sustained high count suggests potential attack traffic. Consider implementing per-IP connection limits and monitoring for sources that repeatedly attempt to establish many short-lived QUIC streams.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability should be prioritized if your organization operates a public-facing DoH3 resolver or exposes DNS services to untrusted networks. The low barrier to exploitation and the availability impact justify prompt patching once a vendor fix is available. Organizations running internal-only DNS services with network segmentation may defer patching slightly, but should still schedule it within their standard patching cycle. The lack of KEV status does not indicate low risk; it reflects that the vulnerability was recently published and exploitation in the wild may not yet be documented.

Risk score, explained

The CVSS 5.3 score reflects a network-accessible denial-of-service vector with no complexity, no authentication, and no user interaction. The score assigns low severity because there is no confidentiality or integrity impact—only availability. However, the real-world impact depends on whether your resolver is exposed to untrusted networks and how critical DNS availability is to your business. Organizations with redundant resolvers or internal-only DNS may tolerate slightly longer patch cycles, while those with single-point-of-failure resolvers should treat this as higher priority.

Frequently asked questions