CVE-2026-33259: Concurrent modification of RPZ data can lead to denial of servce
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33259?
The severity of CVE-2026-33259 is rated as medium with a score of 5.
What impact does CVE-2026-33259 have on PowerDNS recursor?
CVE-2026-33259 can lead to denial of service due to inconsistent RPZ data and potentially a crash of the recursor.
How do I fix CVE-2026-33259?
To mitigate CVE-2026-33259, ensure that concurrent transfers of the same RPZ zone are properly managed and avoid malfunctioning RPZ providers.
What conditions exacerbate CVE-2026-33259?
CVE-2026-33259 is exacerbated by having many concurrent transfers of the same RPZ zone, particularly with a malfunctioning RPZ provider.
What does 'use after free' mean in the context of CVE-2026-33259?
In the context of CVE-2026-33259, 'use after free' refers to accessing memory that has already been freed, which can occur when inconsistent RPZ data is processed.