CVE-2026-33608

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33608", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2026-03-23T12:58:38.267Z", "datePublished": "2026-04-22T14:00:15.473Z", "dateUpdated": "2026-04-22T14:28:15.172Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-04-22T14:00:15.473Z"}, "title": "Incomplete domain name sanitization during", "datePublic": "2026-04-08T22:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "affected": [{"vendor": "PowerDNS", "product": "Authoritative", "collectionURL": "https://repo.powerdns.com/", "packageName": "pdns", "repo": "https://github.com/PowerDNS/pdns", "modules": ["Bind backend"], "programFiles": ["bindbackend2.cc"], "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.4", "versionType": "semver"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.</p>"}]}], "references": [{"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Vitaly Simonovich", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T14:28:03.004705Z", "id": "CVE-2026-33608", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:28:15.172Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33608", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T14:28:03.004705Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:27:55.851Z"}}], "cna": {"title": "Incomplete domain name sanitization during", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Vitaly Simonovich"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "modules": ["Bind backend"], "product": "Authoritative", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.4", "versionType": "semver"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.14", "versionType": "semver"}], "packageName": "pdns", "programFiles": ["bindbackend2.cc"], "collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected"}], "datePublic": "2026-04-08T22:00:00.000Z", "references": [{"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.", "supportingMedia": [{"type": "text/html", "value": "<p>An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-04-22T14:00:15.473Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33608", "state": "PUBLISHED", "dateUpdated": "2026-04-22T14:28:15.172Z", "dateReserved": "2026-03-23T12:58:38.267Z", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "datePublished": "2026-04-22T14:00:15.473Z", "assignerShortName": "OX"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected", "modules": ["Bind backend"], "packageName": "pdns", "product": "Authoritative", "programFiles": ["bindbackend2.cc"], "repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "versions": [{"lessThan": "5.0.4", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThan": "4.9.14", "status": "affected", "version": "4.9.0", "versionType": "semver"}]}], "source": "security@open-xchange.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*", "matchCriteriaId": "08464BC2-733F-4260-878D-DE05919A7A7D", "versionEndExcluding": "4.9.14", "versionStartIncluding": "4.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*", "matchCriteriaId": "A26C526E-15DC-41BE-9B66-FC6A63679562", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it."}, {"lang": "es", "value": "Un atacante puede enviar una solicitud de notificaci\u00f3n que provoca que un nuevo dominio secundario se a\u00f1ada al backend de bind, pero hace que dicho backend actualice su configuraci\u00f3n a una inv\u00e1lida, lo que lleva a que el backend ya no pueda ejecutarse en el siguiente reinicio, requiriendo una operaci\u00f3n manual para solucionarlo."}], "id": "CVE-2026-33608", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security@open-xchange.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33608", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T14:28:03.004705Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:54.650", "references": [{"source": "security@open-xchange.com", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}], "sourceIdentifier": "security@open-xchange.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.9.0,4.9.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Authoritative", "source": "cna", "vendor": "PowerDNS"}, "product": "authoritative", "vendor": "powerdns"}], "analysis": {"en": {"generated_at": "2026-04-27T08:52:53.801409+00:00", "value": {"mitigation_remediation": ["Apply the official patch or upgrade PowerDNS to the latest release as outlined in the PowerDNS advisory.", "If upgrading is not immediately possible, disable or restrict the DNS NOTIFY protocol to trusted IP addresses to mitigate the risk of malicious notify messages.", "Review and correct the bind backend configuration to ensure it contains valid values before restarting the service, and consider implementing automated checks or monitoring to detect configuration corruption events."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via backend configuration corruption"}, "threat_synthesis": {"affected_systems": "PowerDNS Authoritative DNS servers that use a bind backend are affected. The advisory lists the product as PowerDNS:Authoritative with unspecified impacted versions; any installation that processes notify requests without proper validation is vulnerable.", "description_and_impact": "A recent PowerDNS vulnerability allows an attacker to craft a notify message that adds a secondary domain to the bind backend. The backend's configuration is then overwritten with an invalid value, causing the service to fail on the next restart. The impact is a denial of service, as the authoritative server cannot start without manual intervention. The weakness is related to unsanitized domain names being inserted into configuration files (CWE\u201194).", "risk_and_exploitability": "The CVSS score of 7.4 indicates high severity. The exploit requires the attacker to send a crafted notify request to a vulnerable PowerDNS instance; the attack vector is remote network access to the DNS server. There is no known public exploit at this time, and the vulnerability is not listed in the CISA KEV catalog. However, once exploited it can bring the authoritative service down until a manual reset or patch is applied."}}}}, "created": "2026-04-22T19:00:07.808087+00:00", "title": "Domain Name Sanitization Failure Causes Configuration Corruption in PowerDNS", "updated": "2026-04-27T18:45:11.490463+00:00", "vendors": ["powerdns", "powerdns$PRODUCT$authoritative"]}