CVE-2026-33593

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-369

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-335947.5A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing querieCVE-2026-335957.5A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resoCVE-2026-335966.5A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of CVE-2026-335977.5PRSD detection denial of serviceCVE-2026-335989.1A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on aCVE-2026-335998.1A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (CVE-2026-33607.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versioCVE-2026-336004.9An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading CVE-2026-336014.9If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereferCVE-2026-336028.2A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bouCVE-2026-336035.3Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the atCVE-2026-336045.9An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending i
CVE-2026-33593: High severity, CVSS 7.5 | Vulnix