CVE-2026-33602

HighCVSS 8.2/10Last modified Oct 26, 2026

Description

A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
PowerDNS	DNSdist	>= 1.9.0, < 1.9.13; >= 2.0.0, < 2.0.4

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.htmlVendor Advisory

Timeline

Published: Apr 22, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-336035.3Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the at CVE-2026-336045.9An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending i CVE-2026-336057.5An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running i CVE-2026-336064.8Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync wit CVE-2026-336074.3An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. M CVE-2026-336089.8An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update CVE-2026-336096.5Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.CVE-2026-33616.4The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta value in versions up CVE-2026-336107.5A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a CVE-2026-336114.9An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn c CVE-2026-336127.5A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.CVE-2026-336138.8Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the gene