by Kastro
Paper/Archive/CVE-2026-33608

CVE-2026-33608

PowerDNS Authoritative — Incomplete domain name sanitization during

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 32.2.322 × 206.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.

Affected

ProductAffectedFixed inSource
Authoritative5.0.0 – < 5.0.45.0.4CNA
Authoritative4.9.0 – < 4.9.144.9.14CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OX (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refdocs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html