CVE-2026-33599: Out-of-bounds read in service discovery
A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or autoupgrade (YAML) settings. DDR upgrade is not enabled by default.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33599?
The severity of CVE-2026-33599 is considered to be high due to the potential for an out-of-bounds read vulnerability.
How do I fix CVE-2026-33599?
To fix CVE-2026-33599, upgrade PowerDNS dnsdist to the latest version that addresses this vulnerability.
What versions of PowerDNS dnsdist are affected by CVE-2026-33599?
PowerDNS dnsdist versions from 1.9.0 to 1.9.13 and from 2.0.0 to 2.0.4 are affected by CVE-2026-33599.
What is the impact of CVE-2026-33599?
The impact of CVE-2026-33599 may allow an attacker to exploit an out-of-bounds read, potentially leading to information disclosure.
Is DDR upgrade enabled by default in PowerDNS dnsdist related to CVE-2026-33599?
No, DDR upgrade is not enabled by default in PowerDNS dnsdist, which relates to the exploitation vector of CVE-2026-33599.