SB20260513115 - Debian update for pdns

Description

This security bulletin contains information about 6 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-33257)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in internal web server when handling crafted HTTP requests. A remote attacker can send a crafted HTTP request to cause a denial of service.

Note, the internal web server is disabled by default.

2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-33260)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in internal web server when handling crafted HTTP requests. A remote attacker can send a crafted HTTP request to cause a denial of service.

Note. the internal web server is disabled by default.

3) Code Injection (CVE-ID: CVE-2026-33608)

The vulnerability allows a remote attacker to corrupt configuration data and cause a denial of service.

The vulnerability exists due to code injection in Bind autosecondary zone transfer handling when processing crafted notify packets. A remote attacker can send a crafted notify request to corrupt configuration data and cause a denial of service.

Exploitation requires the Bind backend in autosecondary mode.

4) LDAP injection (CVE-ID: CVE-2026-33609)

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to ldap dn injection in LDAP query escaping when processing regular DNS queries. A remote user can send crafted queries to disclose sensitive information.

Exploitation requires the LDAP backend with 8bit-dns enabled.

5) Resource exhaustion (CVE-ID: CVE-2026-33610)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in forward-dnsupdate when processing responses from a primary server during a forwarded dnsupdate operation. A remote attacker can act as a rogue primary server and send crafted responses to cause a denial of service.

Exploitation requires a secondary server to forward a DNS update request to the primary server.

6) Integer overflow (CVE-ID: CVE-2026-33611)

The vulnerability allows a remote user to corrupt data and cause a denial of service.

The vulnerability exists due to integer overflow in HTTPS and SVCB record handling when processing crafted REST API requests. A remote privileged user can send a crafted REST API request to corrupt data and cause a denial of service.

Only systems using the LMDB backend are vulnerable to database corruption.

Remediation

Install update from vendor's website.

References

• https://lists.debian.org/debian-security-announce/2026/msg00143.html