This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-40209 →

DEBIAN-CVE-2026-40209

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by se...

Original description

The description as published by the source.

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 dnsdist

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 dnsdist

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-0+deb13u1"}]}]

Debian:14 dnsdist

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1"}]}]

References

advisory security-tracker.debian.org