Integer overflow in PowerDNS Authoritative - CVE-2026-33611
Published: April 22, 2026
Vulnerability identifier: #VU126866
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33611
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to corrupt data and cause a denial of service.
The vulnerability exists due to integer overflow in HTTPS and SVCB record handling when processing crafted REST API requests. A remote privileged user can send a crafted REST API request to corrupt data and cause a denial of service.
Only systems using the LMDB backend are vulnerable to database corruption.
Affected software
PowerDNS Authoritative
Debian Linux
Fedora
pdns (Debian package)
pdns
Debian Linux
Fedora
pdns (Debian package)
pdns
How to mitigate CVE-2026-33611
Install security update from vendor's website.
PowerDNS Authoritative - addressed in versions 4.9.14, 5.0.4
pdns (Debian package) - update to 4.9.14-0+deb13u1
pdns - addressed in versions 5.0.4-1.el9, 5.0.4-1.el10_1, 5.0.4-1.el10_2, 5.0.4-1.el10_3, 5.0.4-1.fc42, 5.0.4-1.fc43, 5.0.4-1.fc44
pdns (Debian package) - update to 4.9.14-0+deb13u1
pdns - addressed in versions 5.0.4-1.el9, 5.0.4-1.el10_1, 5.0.4-1.el10_2, 5.0.4-1.el10_3, 5.0.4-1.fc42, 5.0.4-1.fc43, 5.0.4-1.fc44