CVE-2026-40011

LowCVSS 3.7/10Last modified Jun 25, 2026

Description

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jun 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-400125.3ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;CVE-2026-400134.3An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write CVE-2026-400146.5An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the s CVE-2026-400154.3An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermit CVE-2026-400166.5Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 CVE-2026-400176.5An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which make CVE-2026-400187.4None None None No publicly available exploits are known.CVE-2026-400195.9An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop c CVE-2026-40024.3The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8. This is due to miss CVE-2026-400204.3Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This c CVE-2026-400215.3Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J http CVE-2026-400228.2When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-r