MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2026-33257

CVSS 5.3v3.1pub. 2026-04-22upd. 2026-04-27

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

  • Powerdns Authoritative

    APP
    Powerdns
    5.0.0 – 5.0.4 (bez)4.9.0 – 4.9.14 (bez)

  • Powerdns Dnsdist

    APP
    Powerdns
    2.0.0 – 2.0.4 (bez)1.9.0 – 1.9.13 (bez)

  • Powerdns Recursor

    APP
    Powerdns
    5.4.05.2.0 – 5.2.9 (bez)5.3.0 – 5.3.6 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2020-24698CRITICAL9.8ten sam produkt

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A...

CVE-2026-42001HIGH7.5ten sam produkt

Insufficient Validation of Autoprimary SOA Queries

CVE-2026-33593HIGH7.5ten sam produkt

A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.

CVE-2026-33608HIGH7.4ten sam produkt

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but ...

CVE-2025-59023HIGH8.2ten sam produkt

Crafted delegations or IP fragments can poison cached delegations in Recursor.