CVE-2026-33260
CVE-2026-33260 · Insufficient input validation of internal webserver
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
CVSS 5.3 · Medium · EPSS 1.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
authoritative
- Versions
- ≥ 5.0.0, < 5.0.4: Affected (semver)
- ≥ 4.9.0, < 4.9.14: Affected (semver)
Update to 4.9.14; Update to 5.0.4
dnsdist
- Versions
- ≥ 1.9.0, < 1.9.13: Affected (semver)
- ≥ 2.0.0, < 2.0.4: Affected (semver)
Update to 1.9.13; Update to 2.0.4
recursor
- Versions
- ≥ 5.4.0, < 5.4.1: Affected (semver)
- ≥ 5.3.0, < 5.3.6: Affected (semver)
- ≥ 5.2.0, < 5.2.9: Affected (semver)
Update to 5.2.9; Update to 5.3.6; Update to 5.4.1
dnsdist Debian:12
- Versions
- 1.7.3-2
- 1.8.0-1
- 1.8.1-1
- 1.8.2-1
- 1.8.2-2
- 1.8.2-3
- 1.8.3-1
- 1.8.3-2
- 1.8.3-3
- 1.9.10-1
- 1.9.3-1
- 1.9.4-1
- 1.9.5-1
- 1.9.6-1
- 1.9.8-1
- 1.9.9-1
- 2.0.0-1
- 2.0.0-2
- 2.0.0-3
- 2.0.0-4
- 2.0.0-5
- 2.0.0-6
- 2.0.0~rc1-1
- 2.0.0~rc1-2
- 2.0.0~rc2-1
- 2.0.1-1
- 2.0.2-1
- 2.0.3-1
- 2.0.4-1
- 2.0.5-1
- 2.0.5-2
- 2.0.5-3
- 2.0.6-1
- 2.1.0-1
- 2.1.0-2
- 2.1.1-1
- 2.1.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsdist Debian:13
- Versions
- 1.9.10-1
- 1.9.10-1+deb13u1
- Affected ranges
- ECOSYSTEM: < 1.9.14-0+deb13u1
Update to 1.9.14-0+deb13u1
dnsdist Debian:14
- Versions
- 1.9.10-1
- 2.0.0-1
- 2.0.0-2
- 2.0.0-3
- 2.0.0-4
- 2.0.0-5
- 2.0.0-6
- 2.0.0~rc1-1
- 2.0.0~rc1-2
- 2.0.0~rc2-1
- 2.0.1-1
- 2.0.2-1
- 2.0.3-1
- Affected ranges
- ECOSYSTEM: < 2.0.4-1
Update to 2.0.4-1
pdns Debian:12
- Versions
- 4.7.3-2
- 4.8.0-1
- 4.8.0-2
- 4.8.1-1
- 4.8.1-2
- 4.8.2-1
- 4.8.2-2
- 4.8.3-1
- 4.8.3-2
- 4.8.3-3
- 4.8.3-4
- 4.9.0-1
- 4.9.0-2
- 4.9.1-1
- 4.9.1-2
- 4.9.1-3
- 4.9.2-1
- 4.9.2-2
- 4.9.3-1
- 4.9.3-2
- 4.9.3-3
- 4.9.4-1
- 4.9.4-2
- 4.9.7-1
- 5.0.0-1
- 5.0.0-2
- 5.0.1-1
- 5.0.2-1
- 5.0.3-1
- 5.0.4-1
- 5.0.5-1
- 5.0.5-2
- 5.0.5-3
- 5.0.5-4
- 5.1.0-1
- 5.1.1-1
- 5.1.1-2
- 5.1.1-3
- 5.1.2-1
- 5.1.3-1
- 5.1.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns Debian:13
- Versions
- 4.9.7-1
- Affected ranges
- ECOSYSTEM: < 4.9.14-0+deb13u1
Update to 4.9.14-0+deb13u1
pdns Debian:14
- Versions
- 4.9.7-1
- 5.0.0-1
- 5.0.0-2
- 5.0.1-1
- 5.0.2-1
- 5.0.3-1
- Affected ranges
- ECOSYSTEM: < 5.0.4-1
Update to 5.0.4-1
pdns-recursor Debian:12
- Versions
- 4.8.4-1
- 4.8.6-1
- 4.8.7-1
- 4.8.8-1
- 4.8.8-1+deb12u1
- 4.9.0-1
- 4.9.0-2
- 4.9.1-1
- 4.9.1-2
- 4.9.1-3
- 4.9.1-4
- 4.9.2-1
- 4.9.2-2
- 4.9.3-1
- 4.9.4-1
- 4.9.5-1
- 5.0.5-1
- 5.0.7-1
- 5.0.7-2
- 5.0.9-1
- 5.1.3-1
- 5.1.3-2
- 5.2.0-1
- 5.2.0-2
- 5.2.0-3
- 5.2.0-4
- 5.2.0-5
- 5.2.1-1
- 5.2.2-1
- 5.2.2-2
- 5.2.4-1
- 5.2.4-2
- 5.2.5-1
- 5.3.0-1
- 5.3.0-2
- 5.3.0-3
- 5.3.0-4
- 5.3.0-5
- 5.3.1-1
- 5.3.3-1
- 5.3.4-1
- 5.3.4-2
- 5.3.5-1
- 5.4.0-1
- 5.4.1-1
- 5.4.1-2
- 5.4.2-1
- 5.4.2-2
- 5.4.3-1
- 5.4.4-1
- 5.4.5-1
- 5.4.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns-recursor Debian:13
- Versions
- 5.2.4-2
- 5.2.4-2+deb13u1
- 5.2.5-1
- 5.2.6-0+deb13u1
- 5.2.7-0+deb13u1
- 5.2.8-0+deb13u1
- Affected ranges
- ECOSYSTEM: < 5.2.9-0+deb13u1
Update to 5.2.9-0+deb13u1
pdns-recursor Debian:14
- Versions
- 5.2.4-2
- 5.2.5-1
- Affected ranges
- ECOSYSTEM: < 5.3.0-1
Update to 5.3.0-1
dnsdist Ubuntu:16.04:LTS
- Versions
- 1.0.0~alpha2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns Ubuntu:Pro:16.04:LTS
- Versions
- 3.4.5-1build2
- 3.4.6-2
- 3.4.6-3
- 3.4.7-1
- 3.4.7-2
- 4.0.0~alpha1-1
- 4.0.0~alpha2-2
- 4.0.0~alpha2-3
- 4.0.0~alpha2-3build1
- 4.0.0~alpha2-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns-recursor Ubuntu:Pro:16.04:LTS
- Versions
- 3.7.3-1
- 4.0.0~alpha1-1
- 4.0.0~alpha1-2
- 4.0.0~alpha2-2
- 4.0.0~alpha2-2ubuntu0.1
- 4.0.0~alpha2-2ubuntu0.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsdist Ubuntu:Pro:18.04:LTS
- Versions
- 1.2.0-1
- 1.2.0-3
- 1.2.1-1
- 1.2.1-1build1
- 1.2.1-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns Ubuntu:Pro:18.04:LTS
- Versions
- 4.0.4-2
- 4.0.4-2build1
- 4.0.5-1
- 4.1.0-1
- 4.1.0-2
- 4.1.0-2build1
- 4.1.1-1
- 4.1.1-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns-recursor Ubuntu:Pro:18.04:LTS
- Versions
- 4.0.6-1
- 4.0.6-1build1
- 4.0.7-1
- 4.1.1-1
- 4.1.1-1build1
- 4.1.1-2
- 4.1.1-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsdist Ubuntu:Pro:20.04:LTS
- Versions
- 1.4.0~rc3-1
- 1.4.0-1
- 1.4.0-1build1
- 1.4.0-1build2
- 1.4.0-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns Ubuntu:Pro:20.04:LTS
- Versions
- 4.1.6-3build1
- 4.2.0-1
- 4.2.1-1
- 4.2.1-1build1
- 4.2.1-1build2
- 4.2.1-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns-recursor Ubuntu:Pro:20.04:LTS
- Versions
- 4.2.0-6
- 4.2.1-1
- 4.2.1-1build1
- 4.2.1-1build2
- 4.2.1-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsdist Ubuntu:Pro:22.04:LTS
- Versions
- 1.5.1-3build2
- 1.6.1-1build1
- 1.6.1-1ubuntu0.1~esm1
- 1.6.1-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns Ubuntu:Pro:22.04:LTS
- Versions
- 4.4.1-1build1
- 4.4.1-3
- 4.4.1-4
- 4.5.2-1build1
- 4.5.3-1
- 4.5.3-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pdns-recursor Ubuntu:Pro:22.04:LTS
- Versions
- 4.4.2-3
- 4.6.0-1ubuntu1
- 4.6.0-1ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-05.html
- https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-33260