CVE-2026-33593: Denial of service via crafted DNSCrypt query
Published Apr 22, 2026
·Updated
A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.
Affected Software
2 affected components
PowerDNS DNSDist>=1.9.0<1.9.13
PowerDNS DNSDist>=2.0.0<2.0.4
Event History
Apr 22, 2026
CVE Published
via MITRE·01:48 PM
Data Sourced
via MITRE·01:48 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33593?
The severity of CVE-2026-33593 is considered critical due to its potential to cause a denial of service.
2
How do I fix CVE-2026-33593?
To fix CVE-2026-33593, upgrade to PowerDNS DNSDist version 1.9.13 or higher, or 2.0.4 or higher.
3
What type of attack does CVE-2026-33593 enable?
CVE-2026-33593 enables a divide by zero error that results in a denial of service.
4
Which versions of DNSDist are affected by CVE-2026-33593?
CVE-2026-33593 affects PowerDNS DNSDist versions between 1.9.0 and 1.9.13, and between 2.0.0 and 2.0.4.
5
What triggers the vulnerability in CVE-2026-33593?
The vulnerability in CVE-2026-33593 is triggered by sending a crafted DNSCrypt query.