SB20260422205 - Multiple vulnerabilities in PowerDNS Recursor

Description

This security bulletin contains information about 9 secuirty vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-33256)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in internal web server when handling crafted HTTP requests. A remote attacker can send a crafted HTTP request to cause a denial of service.

Note, the internal web server is disabled by default.

2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-33257)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in internal web server when handling crafted HTTP requests. A remote attacker can send a crafted HTTP request to cause a denial of service.

Note, the internal web server is disabled by default.

3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-33258)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in negative and aggressive NSEC(3) caches when processing crafted zones and DNS responses. A remote attacker can publish and query a crafted zone to cause a denial of service.

4) Use-after-free (CVE-ID: CVE-2026-33259)

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in RPZ data handling when processing many concurrent transfers of the same RPZ. A remote privileged user can trigger many concurrent transfers of the same RPZ to cause a denial of service.

Exploitation normally requires a malfunctioning RPZ provider.

5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-33260)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in internal web server when handling crafted HTTP requests. A remote attacker can send a crafted HTTP request to cause a denial of service.

Note. the internal web server is disabled by default.

6) Missing support for integrity check (CVE-ID: CVE-2026-33261)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to internal inconsistency in aggressive NSEC(3) cache when a zone transitions from NSEC to NSEC3. A remote attacker can trigger a zone transition from NSEC to NSEC3 to cause a denial of service.

7) NULL pointer dereference (CVE-ID: CVE-2026-33262)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in cookie reply handling when processing crafted DNS responses. A remote attacker can send a crafted DNS response to cause a denial of service.

Note, cookies are disabled by default.

8) NULL pointer dereference (CVE-ID: CVE-2026-33601)

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to null pointer dereference in zoneToCache ZONEMD record handling when processing a crafted zonemd record from a malicious authoritative server. A remote privileged user can send a crafted zonemd record to cause a denial of service.

Exploitation requires the zoneToCache function to be configured.

9) NULL pointer dereference (CVE-ID: CVE-2026-33600)

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to null pointer dereference in RPZ transfer handling when processing a crafted RPZ from a malicious authoritative server. A remote privileged user can send a crafted RPZ to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-03.html