CVE-2026-33599
Published: 22 April 2026
Summary
CVE-2026-33599 is a low-severity Out-of-bounds Read (CWE-125) vulnerability in Powerdns Dnsdist. Its CVSS base score is 3.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires timely patching of the out-of-bounds read vulnerability in dnsdist as detailed in the PowerDNS advisory.
Least functionality mandates disabling unnecessary features like autoUpgrade/auto_upgrade, which are required to trigger the DDR vulnerability and are not enabled by default.
Information input validation ensures crafted SVCB responses from rogue backends are checked before processing to prevent the out-of-bounds read.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read vulnerability enables adjacent attacker to trigger denial of service via crafted DDR/SVCB response when auto-upgrade enabled, mapping to application/system exploitation for endpoint DoS.
NVD Description
A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.
Deeper analysisAI
CVE-2026-33599 is an out-of-bounds read vulnerability (CWE-125) in dnsdist, the DNS load balancer from PowerDNS. It occurs when a rogue backend sends a crafted SVCB response to a Discovery of Designated Resolvers (DDR) request, specifically when the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings are enabled. The vulnerability was published on 2026-04-22 and carries a CVSS v3.1 base score of 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
An adjacent attacker on the same network segment (AV:A) with no privileges (PR:N) can exploit this under high attack complexity (AC:H) conditions and without user interaction (UI:N). Successful exploitation results in low availability impact (A:L), such as potential denial of service, with no effects on confidentiality or integrity.
The PowerDNS security advisory at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html notes that DDR upgrade is not enabled by default, serving as a primary mitigation for unaffected configurations.
Details
- CWE(s)