p PatchFirst

CVE-2026-33259

CVE-2026-33259 · Concurrent modification of RPZ data can lead to denial of servce

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.

CVSS 5.0 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • recursor

    Versions
    • ≥ 5.4.0, < 5.4.1: Affected (semver)
    • ≥ 5.3.0, < 5.3.6: Affected (semver)
    • ≥ 5.2.0, < 5.2.9: Affected (semver)

    Update to 5.2.9; Update to 5.3.6; Update to 5.4.1

  • pdns-recursor Debian:12

    Versions
    • 4.8.4-1
    • 4.8.6-1
    • 4.8.7-1
    • 4.8.8-1
    • 4.8.8-1+deb12u1
    • 4.9.0-1
    • 4.9.0-2
    • 4.9.1-1
    • 4.9.1-2
    • 4.9.1-3
    • 4.9.1-4
    • 4.9.2-1
    • 4.9.2-2
    • 4.9.3-1
    • 4.9.4-1
    • 4.9.5-1
    • 5.0.5-1
    • 5.0.7-1
    • 5.0.7-2
    • 5.0.9-1
    • 5.1.3-1
    • 5.1.3-2
    • 5.2.0-1
    • 5.2.0-2
    • 5.2.0-3
    • 5.2.0-4
    • 5.2.0-5
    • 5.2.1-1
    • 5.2.2-1
    • 5.2.2-2
    • 5.2.4-1
    • 5.2.4-2
    • 5.2.5-1
    • 5.3.0-1
    • 5.3.0-2
    • 5.3.0-3
    • 5.3.0-4
    • 5.3.0-5
    • 5.3.1-1
    • 5.3.3-1
    • 5.3.4-1
    • 5.3.4-2
    • 5.3.5-1
    • 5.4.0-1
    • 5.4.1-1
    • 5.4.1-2
    • 5.4.2-1
    • 5.4.2-2
    • 5.4.3-1
    • 5.4.4-1
    • 5.4.5-1
    • 5.4.6-1
    • 5.4.6-2
    • 5.4.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Debian:13

    Versions
    • 5.2.4-2
    • 5.2.4-2+deb13u1
    • 5.2.5-1
    • 5.2.6-0+deb13u1
    • 5.2.7-0+deb13u1
    • 5.2.8-0+deb13u1
    Affected ranges
    • ECOSYSTEM: < 5.2.9-0+deb13u1

    Update to 5.2.9-0+deb13u1

  • pdns-recursor Debian:14

    Versions
    • 5.2.4-2
    • 5.2.5-1
    • 5.3.0-1
    • 5.3.0-2
    • 5.3.0-3
    • 5.3.0-4
    • 5.3.0-5
    • 5.3.1-1
    • 5.3.3-1
    • 5.3.4-1
    • 5.3.4-2
    • 5.3.5-1
    • 5.4.0-1
    Affected ranges
    • ECOSYSTEM: < 5.4.1-1

    Update to 5.4.1-1

  • pdns-recursor Ubuntu:Pro:16.04:LTS

    Versions
    • 3.7.3-1
    • 4.0.0~alpha1-1
    • 4.0.0~alpha1-2
    • 4.0.0~alpha2-2
    • 4.0.0~alpha2-2ubuntu0.1
    • 4.0.0~alpha2-2ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:Pro:18.04:LTS

    Versions
    • 4.0.6-1
    • 4.0.6-1build1
    • 4.0.7-1
    • 4.1.1-1
    • 4.1.1-1build1
    • 4.1.1-2
    • 4.1.1-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:Pro:20.04:LTS

    Versions
    • 4.2.0-6
    • 4.2.1-1
    • 4.2.1-1build1
    • 4.2.1-1build2
    • 4.2.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:Pro:22.04:LTS

    Versions
    • 4.4.2-3
    • 4.6.0-1ubuntu1
    • 4.6.0-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:24.04:LTS

    Versions
    • 4.9.0-2
    • 4.9.1-4
    • 4.9.2-1
    • 4.9.2-1build1
    • 4.9.2-2
    • 4.9.3-1
    • 4.9.3-1build2
    • 4.9.3-1build3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:25.10

    Versions
    • 5.2.0-5
    • 5.2.2-1
    • 5.2.2-2
    • 5.2.4-2
    • 5.2.4-2build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:26.10

    Versions
    • 5.3.5-1
    • 5.4.3-1
    • 5.4.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:26.04:LTS

    Versions
    • 5.2.4-2build2
    • 5.3.1-1
    • 5.3.3-1
    • 5.3.4-1
    • 5.3.4-1build1
    • 5.3.4-2
    • 5.3.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →