CVE-2026-40209
Description
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
Summary dbcve.org
This is a DNS server vulnerability where sending IXFR (Incremental Zone Transfer) queries causes outgoing TCP connections to backend servers to remain stuck until timeout instead of being released immediately. The improper connection management allows attackers to exhaust connection limits or file descriptors, leading to denial of service.
Mitigation
Apply the vendor-provided patch to fix the connection release logic in the DNS server's IXFR handling code. If no patch available, consider rate-limiting IXFR queries or implementing connection pooling with aggressive timeouts.