SB20260422221 - Multiple vulnerabilities in PowerDNS Authoritative Server

Description

This security bulletin contains information about 6 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-33257)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in internal web server when handling crafted HTTP requests. A remote attacker can send a crafted HTTP request to cause a denial of service.

Note, the internal web server is disabled by default.

2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-33260)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in internal web server when handling crafted HTTP requests. A remote attacker can send a crafted HTTP request to cause a denial of service.

Note. the internal web server is disabled by default.

3) Integer overflow (CVE-ID: CVE-2026-33611)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to corrupt data and cause a denial of service.

The vulnerability exists due to integer overflow in HTTPS and SVCB record handling when processing crafted REST API requests. A remote privileged user can send a crafted REST API request to corrupt data and cause a denial of service.

Only systems using the LMDB backend are vulnerable to database corruption.

4) Resource exhaustion (CVE-ID: CVE-2026-33610)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in forward-dnsupdate when processing responses from a primary server during a forwarded dnsupdate operation. A remote attacker can act as a rogue primary server and send crafted responses to cause a denial of service.

Exploitation requires a secondary server to forward a DNS update request to the primary server.

5) LDAP injection (CVE-ID: CVE-2026-33609)

CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to ldap dn injection in LDAP query escaping when processing regular DNS queries. A remote user can send crafted queries to disclose sensitive information.

Exploitation requires the LDAP backend with 8bit-dns enabled.

6) Code Injection (CVE-ID: CVE-2026-33608)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to corrupt configuration data and cause a denial of service.

The vulnerability exists due to code injection in Bind autosecondary zone transfer handling when processing crafted notify packets. A remote attacker can send a crafted notify request to corrupt configuration data and cause a denial of service.

Exploitation requires the Bind backend in autosecondary mode.

Remediation

Install update from vendor's website.

References

• https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-05.html