CVE-2026-40011

Prometheus denial of service via crafted DNS queries

Low · published June 25, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Published
2026-06-25T12:22Z
EPSS history
Timeline
  • 25 JUN 12:22Z
    Prometheus denial of service via crafted DNS queries
    cvelistv5