CVE-2026-33601 Powerdns CVE debrief

Who should care

Defenders responsible for PowerDNS Recursor instances should assess their exposure and prioritize verification and updates to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-33601 is a medium-severity vulnerability in PowerDNS Recursor that could allow an attacker to cause a denial of service. Defenders should prioritize verifying and updating affected instances to prevent potential attacks.

• Denial-of-service attacks via null pointer dereference
• Potential disruption of DNS resolution services
• Need for verification and updates to prevent exploitation

Technical summary

The zoneToCache function in PowerDNS Recursor is vulnerable to a null pointer dereference when dealing with a malicious authoritative server. This is caused by a missing consistency check, which can lead to a denial-of-service attack. The vulnerability has a CVSS score of 4.4 and is considered medium severity. The affected product is PowerDNS Recursor, and defenders should prioritize verifying and updating affected instances to prevent potential attacks.

Defensive priority

Defenders should prioritize verifying and updating PowerDNS Recursor instances to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify and update PowerDNS Recursor instances to the latest version
• Review and implement necessary patches or workarounds
• Monitor for potential denial-of-service attacks

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions of PowerDNS Recursor. The vulnerability is a null pointer dereference caused by a missing consistency check in the zoneToCache function. The CVE record was published on 2026-04-22T10:16:52.223Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and affected versions of PowerDNS Recursor. Defendr

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.