CVE-2026-33598
Published: 22 April 2026
Summary
CVE-2026-33598 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Powerdns Dnsdist. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the out-of-bounds read vulnerability by requiring timely patching of dnsdist to address the flaw in Lua functions on crafted packet caches.
Enforces memory protections such as address space layout randomization and guard pages to prevent exploitation of out-of-bounds reads in dnsdist's packet cache processing.
Validates incoming DNS packets before caching to block crafted responses that could trigger the vulnerability when processed by custom Lua code.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing dnsdist service enables remote exploitation (T1190) leading to limited info disclosure or minor service disruption via application exploitation (T1499.004).
NVD Description
A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.
Deeper analysisAI
CVE-2026-33598 is an out-of-bounds read vulnerability (CWE-125) affecting dnsdist. It arises when custom Lua code invokes the getDomainListByAddress() or getAddressListByDomain() functions on a packet cache containing a crafted response, potentially leading to memory access beyond allocated bounds. The issue was published on 2026-04-22 and carries a CVSS v3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).
A remote, unauthenticated attacker can exploit this vulnerability over the network without user interaction, though it demands high attack complexity. Exploitation enables limited disclosure of sensitive information or limited impairment of availability, such as partial data exposure or minor service disruption.
The PowerDNS security advisory for dnsdist details mitigation steps and is available at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html.
Details
- CWE(s)