CVE-2026-33594
Published: 22 April 2026
Summary
CVE-2026-33594 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Powerdns Dnsdist. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements denial-of-service protections to prevent memory exhaustion from excessive queries accumulating in buffers on overloaded DoH backends.
Enforces limits on resource availability, such as memory, to stop unbounded query buffering per connection from depleting system resources.
Restricts query inputs at network entry points by volume, rate, or size to prevent accumulation leading to excessive memory allocation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows flooding dnsdist with queries to trigger unbounded memory allocation (CWE-770), directly enabling Application Exhaustion Flood for DoS impact on the service.
NVD Description
A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.
Deeper analysisAI
CVE-2026-33594 is a vulnerability in dnsdist that enables excessive memory allocation. A client can trigger this by generating numerous queries routed to an overloaded DoH (DNS over HTTPS) backend, causing the queries to accumulate in a buffer that remains unreleased until the connection ends. This issue maps to CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), indicating a low-severity availability impact with no confidentiality or integrity effects.
An unauthenticated attacker with network access can exploit this vulnerability by flooding the dnsdist instance with queries targeted at a slow or overloaded DoH backend. The accumulation of buffered queries leads to memory exhaustion, potentially causing a denial-of-service condition that degrades or halts dnsdist's ability to process legitimate DNS traffic.
The PowerDNS security advisory provides further details on this issue, available at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html.
Details
- CWE(s)