CVE-2026-33262: Insufficient validation of cookie reply
Published Apr 22, 2026
·Updated
An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default.
Affected Software
3 affected components
PowerDNS recursor>=5.2.0<5.2.9
PowerDNS recursor>=5.3.0<5.3.6
PowerDNS recursor=5.4.0
Event History
Apr 22, 2026
CVE Published
via MITRE·09:40 AM
Data Sourced
via MITRE·09:40 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33262?
The severity of CVE-2026-33262 is classified as medium with a score of 5.9.
2
What does CVE-2026-33262 affect?
CVE-2026-33262 affects the PowerDNS recursor due to insufficient validation of cookie replies.
3
How do I fix CVE-2026-33262?
To fix CVE-2026-33262, ensure that cookies are disabled as they are disabled by default.
4
What kind of attack does CVE-2026-33262 allow?
CVE-2026-33262 allows an attacker to send replies that can lead to a null pointer dereference and cause a denial of service.
5
Is there a workaround for CVE-2026-33262?
The primary workaround for CVE-2026-33262 is to keep cookies disabled, as they are disabled by default in the software.