← Vulnerability feed

Vulnerability record · CVE-2026-33599 · published 22 April 2026

CVE-2026-33599: Powerdns dnsdist out-of-bounds read vulnerability

Powerdns · Dnsdist

A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.

8.1 CVSS 3.1 High EPSS 0.80% · top 45.1% CWE-125 · Out-of-bounds read
8.1CVSS 3.1 base score
0.80%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html Vendor Advisory

Track CVE-2026-33599 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-33598Powerdns dnsdist out-of-bounds read vulnerabilityA cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet c…EPSS 2.8%8.8CVE-2017-7557Powerdns dnsdist improper authentication vulnerabilitydnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.EPSS 0.83%8.2CVE-2026-33602Powerdns dnsdist heap-based buffer overflow vulnerabilityA rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write…EPSS 1.2%8.2CVE-2026-24028Powerdns dnsdist vulnerabilityAn attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to…EPSS 1.0%7.5CVE-2026-33597Powerdns dnsdist vulnerabilityPRSD detection denial of serviceEPSS 0.75%7.5CVE-2026-33254Powerdns dnsdist allocation without limits vulnerabilityAn attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial o…EPSS 0.80%7.5CVE-2026-33593Powerdns dnsdist divide by zero vulnerabilityA client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.EPSS 0.82%7.5CVE-2026-33594Powerdns dnsdist allocation without limits vulnerabilityA client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accu…EPSS 0.80%

Source: NIST National Vulnerability Database (record CVE-2026-33599), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.