Allocation of Resources Without Limits or Throttling in PowerDNS Recursor - CVE-2026-33260

Vulnerability identifier: #VU126849

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-33260

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in internal web server when handling crafted HTTP requests. A remote attacker can send a crafted HTTP request to cause a denial of service.

Note. the internal web server is disabled by default.

PowerDNS Recursor
PowerDNS Authoritative
Debian Linux
Fedora
dnsdist
dnsdist (Debian package)
dnsdist
pdns (Debian package)
pdns-recursor (Debian package)

Install security update from vendor's website.

PowerDNS Recursor - update to 5.2.9
dnsdist - addressed in versions 1.9.13, 2.0.4
PowerDNS Authoritative - addressed in versions 4.9.14, 5.0.4
dnsdist (Debian package) - update to 1.9.14-0+deb13u1
dnsdist - update to 2.0.6-1.el10_2
pdns (Debian package) - update to 4.9.14-0+deb13u1
pdns-recursor (Debian package) - update to 5.2.9-0+deb13u1

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-03.html

• Multiple vulnerabilities in PowerDNS Recursor
• Multiple vulnerabilities in PowerDNS Authoritative Server
• Multiple vulnerabilities in PowerDNS DNSdist
• Debian update for pdns-recursor
• Debian update for pdns
• Debian update for dnsdist
• Fedora EPEL 10.2 update for dnsdist