CVE-2026-33602
Published: 22 April 2026
Summary
CVE-2026-33602 is a medium-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Powerdns Dnsdist. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 49.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33602 affects dnsdist, the DNS load balancer from PowerDNS. The vulnerability is an out-of-bounds write (CWE-122) triggered when a rogue backend sends a crafted UDP response with a query ID off by one relative to the maximum configured value. Published on 2026-04-22, it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H), indicating medium severity with network accessibility, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.
An attacker positioned as a rogue backend server that dnsdist queries can exploit this vulnerability remotely over the network. The high complexity arises from crafting the specific UDP response with the manipulated query ID. Exploitation results in an out-of-bounds write, leading to a denial of service, potentially crashing the dnsdist process and disrupting DNS resolution services.
The PowerDNS security advisory provides details on mitigation and patches; refer to https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html for guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24943
Vulnerability details
A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in dnsdist from rogue backend crafted UDP response directly enables application/system exploitation for endpoint DoS (crash/disruption of DNS service).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires applying vendor patches for dnsdist, directly eliminating the out-of-bounds write vulnerability from crafted UDP responses.
Memory protection mechanisms like stack canaries and address space layout randomization prevent crashes from out-of-bounds writes triggered by malformed query IDs.
Information input validation enforces checks on query IDs in UDP responses from backends to reject off-by-one values before processing.