CVE-2026-33598
Published: 22 April 2026
Summary
CVE-2026-33598 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Powerdns Dnsdist. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33598 is an out-of-bounds read vulnerability (CWE-125) affecting dnsdist. It arises when custom Lua code invokes the getDomainListByAddress() or getAddressListByDomain() functions on a packet cache containing a crafted response, potentially leading to memory access beyond allocated bounds. The issue was published on 2026-04-22 and carries a CVSS v3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).
A remote, unauthenticated attacker can exploit this vulnerability over the network without user interaction, though it demands high attack complexity. Exploitation enables limited disclosure of sensitive information or limited impairment of availability, such as partial data exposure or minor service disruption.
The PowerDNS security advisory for dnsdist details mitigation steps and is available at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24939
Vulnerability details
A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing dnsdist service enables remote exploitation (T1190) leading to limited info disclosure or minor service disruption via application exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the out-of-bounds read vulnerability by requiring timely patching of dnsdist to address the flaw in Lua functions on crafted packet caches.
Enforces memory protections such as address space layout randomization and guard pages to prevent exploitation of out-of-bounds reads in dnsdist's packet cache processing.
Validates incoming DNS packets before caching to block crafted responses that could trigger the vulnerability when processed by custom Lua code.