CVE-2026-33593
Powerdns Dnsdist 1.9.0 – 1.9.13
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-33593 is a high-severity Divide By Zero (CWE-369) vulnerability in Powerdns Dnsdist. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33593 is a divide-by-zero vulnerability (CWE-369) in dnsdist, a DNS load balancer from PowerDNS. It affects the handling of DNSCrypt queries, where a client can send a crafted query that triggers the error, leading to a crash of the dnsdist process. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for high-impact denial of service due to network accessibility and lack of required privileges.
Any remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted DNSCrypt query to a vulnerable dnsdist instance. Successful exploitation results in a process crash, causing a denial-of-service condition that disrupts DNS resolution services until the process is restarted. There is no impact on confidentiality or integrity, but the ease of exploitation makes it suitable for targeted or opportunistic attacks against exposed DNS infrastructure.
The PowerDNS security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html provides details on mitigation, including available patches for affected dnsdist versions. Security practitioners should consult the advisory for upgrade instructions and verify their deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24929
Vulnerability Data
A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including static/dynamic analysis) finds divide-by-zero conditions after they have been coded.
Security engineering principles can require safe-arithmetic constructs or explicit guards that keep division operands nonzero.
Validating numeric inputs before use as divisors structurally blocks zero values from reaching division operations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include code analysis, input validation, and testing that prevent divide-by-zero errors.
Vulnerability identification processes can discover divide-by-zero flaws via static analysis or testing.
Routine patching and replacement can remediate divide-by-zero bugs present in deployed software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect divide-by-zero conditions before release.
Secure development lifecycle includes input validation and error-handling practices that can prevent divide-by-zero faults.
Application security requirements can mandate checks for zero denominators and safe arithmetic handling.
Secure architecture principles encourage defensive coding patterns that avoid arithmetic exceptions.
Secure coding standards directly require validation to prevent divide-by-zero and similar runtime faults.