CVE-2026-33594: Outgoing DoH excessive memory allocation
Published Apr 22, 2026
·Updated
A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.
Affected Software
2 affected components
PowerDNS DNSDist>=1.9.0<1.9.13
PowerDNS DNSDist>=2.0.0<2.0.4
Event History
Apr 22, 2026
CVE Published
via MITRE·01:48 PM
Data Sourced
via MITRE·01:48 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33594?
CVE-2026-33594 is classified as a high-severity vulnerability due to the excessive memory allocation it can cause.
2
How do I fix CVE-2026-33594?
To mitigate CVE-2026-33594, upgrade PowerDNS DNSDist to version 1.9.13 or later, or 2.0.4 or later.
3
What are the potential impacts of CVE-2026-33594?
CVE-2026-33594 can lead to service degradation or downtime due to excessive memory usage when queries pile up.
4
Which versions of PowerDNS DNSDist are affected by CVE-2026-33594?
CVE-2026-33594 affects PowerDNS DNSDist versions 1.9.0 to 1.9.13 and 2.0.0 to 2.0.4.
5
Is there a workaround for CVE-2026-33594?
There are no specific workarounds for CVE-2026-33594; upgrading to an unaffected version is recommended.