CVE-2026-33256 Powerdns CVE debrief

Who should care

Defenders responsible for DNS infrastructure, especially those using PowerDNS Recursor, should assess exposure and prioritize verification and potential upgrades.

Why it matters

CVE-2026-33256 is a medium-severity vulnerability in PowerDNS Recursor that can cause a denial of service. Defenders should verify exposure, especially in DNS infrastructure, and prioritize potential upgrades or patches for affected versions.

• Potential denial of service via memory allocation.
• Need to verify exposure in DNS infrastructure.
• Possible upgrade or patching required for affected versions.
• Monitoring for unusual memory usage or attacks may be necessary.

Technical summary

CVE-2026-33256 is a medium-severity vulnerability in PowerDNS Recursor that can cause a denial of service via unlimited memory allocation. An attacker can send a web request to cause this issue. The internal web server is disabled by default. This vulnerability affects PowerDNS Recursor versions 5.2.0-5.2.9, 5.3.0-5.3.6, and 5.4.0. Defenders should verify their exposure and consider upgrading to a fixed version of PowerDNS Recursor if vulnerable.

Defensive priority

Defenders should prioritize verifying exposure in their DNS infrastructure, especially if using affected PowerDNS Recursor versions.

Recommended defensive actions

• Verify if your PowerDNS Recursor instance is exposed to the internet or untrusted networks.
• Check if your version of PowerDNS Recursor is within the affected ranges (5.2.0-5.2.9, 5.3.0-5.3.6, 5.4.0).
• Consider upgrading to a fixed version of PowerDNS Recursor if vulnerable.
• Monitor for unusual memory usage or denial of service attempts on your DNS infrastructure.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but the vendor advisory link is broken. The vulnerability affects PowerDNS Recursor versions 5.2.0-5.2.9, 5.3.0-5.3.6, and 5.4.0. Defenders should verify their exposure and consider upgrading to a fixed version. The CVE record was published on 2026-04-22T10:16:51.193Z and has not been modified since then. The NVD detail page provides additional information on the vulnerability, but the vendor advisory link is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.