CVE-2026-40011: Improper Encoding (CVSS 3.7)

Description

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

Is your site exposed to CVE-2026-40011?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploit Prediction

0.0015

Probability of exploitation

0.05%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-116 CWE-116

References

Other References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html

Frequently Asked Questions

What is CVE-2026-40011? +

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires. It has a CVSS v3.1 base score of 3.7 (LOW).

How severe is CVE-2026-40011? +

CVE-2026-40011 has a CVSS v3.1 score of 3.7 out of 10, rated LOW. This is a low-severity vulnerability with limited impact. The EPSS score is 0.0015, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-40011? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-125112

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys …

CVE-2026-63346

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header …

CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C …

CVE-2026-63344

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys …

CVE-2026-57210

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies …

CVE-2026-72717

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression …

CVE-2026-40011