MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2026-33594

CVSS 5.3v3.1pub. 2026-04-22upd. 2026-04-24

A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

  • Powerdns Dnsdist

    APP
    Powerdns
    1.9.0 – 1.9.13 (bez)2.0.0 – 2.0.4 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2026-33593HIGH7.5ten sam produkt

A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.

CVE-2017-7557HIGH8.8ten sam produkt

dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CS...

CVE-2026-33260MEDIUM5.3ten sam produkt

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading...

CVE-2026-33254MEDIUM5.3ten sam produkt

An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocati...

CVE-2026-33257MEDIUM5.3ten sam produkt

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading...