CVE-2026-33256
Published: 22 April 2026
Summary
CVE-2026-33256 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Powerdns Recursor. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 0.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2026-33256 affects the internal web server in PowerDNS Recursor, where an attacker can send a web request that triggers unlimited memory allocation, leading to a denial of service. Published on 2026-04-22, the vulnerability carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and maps to CWE-770 (Allocation of Resources Without Limits or Throttling). The internal web server is disabled by default, limiting exposure.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation causes memory exhaustion in the affected component, resulting in low-impact denial of service by disrupting availability without compromising confidentiality or integrity.
The PowerDNS security advisory provides details on mitigation: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24719
Vulnerability details
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes remote exploitation of an application-layer vulnerability (unbounded memory allocation in the internal web server) that directly causes resource exhaustion and denial of service, matching the definition of T1499.004 Application or System Exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Denial-of-service protection directly mitigates unlimited memory allocation attacks by implementing throttling and resource limits on web requests to the internal server.
Resource availability protections limit memory allocations to prevent exhaustion from malicious web requests exploiting CWE-770.
Least functionality ensures the non-essential internal web server remains disabled, eliminating the attack surface for this DoS vulnerability.