HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2026-33608

CVSS 7.4v3.1pub. 2026-04-22upd. 2026-04-24

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Powerdns Authoritative

    APP
    Powerdns
    4.9.0 – 4.9.14 (bez)5.0.0 – 5.0.4 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2020-24698CRITICAL9.8ten sam produkt

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A...

CVE-2026-42001HIGH7.5ten sam produkt

Insufficient Validation of Autoprimary SOA Queries

CVE-2020-24697HIGH7.5ten sam produkt

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A...

CVE-2020-24696HIGH8.1ten sam produkt

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A...

CVE-2015-5230HIGH7.5ten sam produkt

The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows r...