by Kastro
Paper/Archive/CVE-2026-33598

CVE-2026-33598

PowerDNS DNSdist — Out-of-bounds read in cache inspection via Lua

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 64.9.649 × 2013.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.

Affected

ProductAffectedFixed inSource
DNSdist1.9.0 – < 1.9.131.9.13CNA
DNSdist2.0.0 – < 2.0.42.0.4CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
OX (CNA)4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refdnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html