CVE-2026-40011

{
  "id": "CVE-2026-40011",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-25T13:16:39.323",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires."
    },
    {
      "lang": "es",
      "value": "Un atacante enviando un gran número de consultas DNS manipuladas podría ser capaz de desencadenar la inserción de un bloqueo dinámico con un valor que cause la producción de una salida inválida en el endpoint de Prometheus. El endpoint de Prometheus será entonces rechazado por el scraper hasta que el bloqueo dinámico expire."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "PowerDNS",
          "product": "DNSdist",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.powerdns.com/",
          "packageName": "dnsdist",
          "modules": [
            "Prometheus export"
          ],
          "programFiles": [
            "dnsdist-web.cc"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "versions": [
            {
              "version": "1.9.0",
              "lessThan": "1.9.15",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.0.0",
              "lessThan": "2.0.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T13:23:09.989984Z",
          "id": "CVE-2026-40011",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html",
      "source": "[email protected]"
    }
  ]
}