CVE-2026-33597
Published: 22 April 2026
Summary
CVE-2026-33597 is a low-severity Improper Encoding or Escaping of Output (CWE-116) vulnerability in Powerdns Dnsdist. Its CVSS base score is 3.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 3.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific flaw in dnsdist's PRSD detection mechanism that enables the denial-of-service vulnerability.
Implements denial-of-service protections to prevent the low-impact availability disruption from remote exploitation over the network.
Validates information inputs to DNS traffic processed by dnsdist, addressing improper encoding or escaping that triggers the PRSD detection DoS.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable denial of service vulnerability in the dnsdist application, directly enabling T1499.004 (Application or System Exploitation) to impact availability.
NVD Description
PRSD detection denial of service
Deeper analysisAI
CVE-2026-33597 is a denial of service vulnerability in the PRSD detection mechanism of dnsdist, a DNS load balancer and resolver from PowerDNS. Published on 2026-04-22, it carries a CVSS v3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) and maps to CWE-116 (Improper Encoding or Escaping of Output).
The vulnerability enables remote exploitation over the network by unauthenticated attackers requiring no privileges or user interaction, though high attack complexity is necessary. Successful attacks achieve a low-impact denial of service, limiting availability without compromising confidentiality or integrity.
Mitigation details are outlined in the PowerDNS security advisory for dnsdist available at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html.
Details
- CWE(s)