What’s Vulnerable › Vulnerabilities

CVE-2026-33260: Insufficient input validation of internal webserver

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-770

Description

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Affected products

• PowerDNS Authoritative: from 4.9.0 before 4.9.14; from 5.0.0 before 5.0.4 — fixed in 4.9.14, 5.0.4
• PowerDNS DNSdist: from 1.9.0 before 1.9.13; from 2.0.0 before 2.0.4 — fixed in 1.9.13, 2.0.4
• PowerDNS Recursor: from 5.2.0 before 5.2.9; from 5.3.0 before 5.3.6; 5.4.0 — fixed in 5.2.9, 5.3.6

How to fix

Upgrade to a fixed version: PowerDNS Authoritative 4.9.14, 5.0.4; PowerDNS DNSdist 1.9.13, 2.0.4; PowerDNS Recursor 5.2.9, 5.3.6. Check the vendor advisory for mitigations.

References

• https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-05.html
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html
• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html

Get alerted when CVE-2026-33260 or the next vulnerability affects your stack