CVE-2026-40211
Description
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
Summary dbcve.org
A vulnerability in DNS over HTTP/3 (DoH3) implementation allows attackers to send crafted queries that trigger an exception, preventing immediate buffer deallocation. The buffer is only freed when the QUIC connection closes, enabling attackers to exhaust memory by opening many concurrent DoH3 streams, causing denial of service.
Mitigation
Implement proper exception handling to ensure buffer cleanup occurs even when exceptions are thrown, and impose limits on concurrent DoH3 streams per client to prevent memory exhaustion.