CVE-2026-33602: Off-by-one access when processing crafted UDP responses
Published Apr 22, 2026
·Updated
A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.
Affected Software
2 affected components
PowerDNS DNSDist>=1.9.0<1.9.13
PowerDNS DNSDist>=2.0.0<2.0.4
Event History
Apr 22, 2026
CVE Published
via MITRE·01:45 PM
Data Sourced
via MITRE·01:45 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33602?
CVE-2026-33602 is classified as a denial of service vulnerability due to out-of-bounds write conditions.
2
How do I fix CVE-2026-33602?
To mitigate CVE-2026-33602, upgrade to a patched version of PowerDNS DNSDist that addresses this vulnerability.
3
Which versions of PowerDNS DNSDist are affected by CVE-2026-33602?
CVE-2026-33602 affects PowerDNS DNSDist versions from 1.9.0 to 1.9.13 and from 2.0.0 to 2.0.4.
4
What kind of attack does CVE-2026-33602 enable?
CVE-2026-33602 allows a rogue backend to exploit UDP responses, potentially resulting in a denial of service.
5
Is there a potential impact on service availability due to CVE-2026-33602?
Yes, CVE-2026-33602 could lead to service disruption if exploited by sending crafted UDP responses.