A remote denial of service vulnerability in PowerDNS DNSdist allows unauthenticated attackers to crash the service by sending a specially crafted DNSCrypt query.

This flaw is a divide by zero error triggered when the application processes a malformed DNSCrypt query. The vulnerability is remotely exploitable without authentication, as indicated by the CVSS vector AV:N/PR:N/UI:N.

The primary impact of this vulnerability is the potential for service disruption, as the divide by zero error causes the DNSdist process to crash. While the CVSS score of 7.5 reflects a high severity due to the ease of remote exploitation and the critical nature of DNS infrastructure, the lack of data compromise or unauthorized access limits the overall impact to availability. Repeated exploitation could lead to significant downtime for dependent network services.

Immediate Action: Update to the latest stable versions of DNSdist (1.9.13 or 2.0.4) as provided by the vendor to resolve the integer handling flaw.

Proactive Monitoring: Monitor system logs and process status for unexpected service restarts or frequent crash reports associated with DNSCrypt traffic.

Compensating Controls: Deploy a network firewall or load balancer to filter or rate-limit suspicious DNSCrypt traffic until patches can be applied to the underlying DNSdist instances.

Public Exploit Available: exploit_available (false)

Given the critical role of DNSdist in network resolution, organizations should prioritize upgrading their instances to the patched versions identified above. Although there is no evidence of active exploitation, the accessibility of this vulnerability from the network edge necessitates prompt remediation to prevent service outages.