CVE-2026-33610

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33610", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2026-03-23T12:58:38.267Z", "datePublished": "2026-04-22T14:00:51.529Z", "dateUpdated": "2026-04-22T14:26:32.724Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-04-22T14:00:51.529Z"}, "title": "Possible file descriptor exhaustion in forward-dnsupdate", "datePublic": "2026-04-08T22:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Uncontrolled Resource Consumption", "type": "CWE"}]}], "affected": [{"vendor": "PowerDNS", "product": "Authoritative", "collectionURL": "https://repo.powerdns.com/", "packageName": "pdns", "repo": "https://github.com/PowerDNS/pdns", "modules": ["DNS updates forwarding"], "programFiles": ["rfc2136handler.cc"], "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.4", "versionType": "semver"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.</p>"}]}], "references": [{"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "ylwango613", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T14:25:29.036113Z", "id": "CVE-2026-33610", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:26:32.724Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33610", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T14:25:29.036113Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:25:17.230Z"}}], "cna": {"title": "Possible file descriptor exhaustion in forward-dnsupdate", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "ylwango613"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "modules": ["DNS updates forwarding"], "product": "Authoritative", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.4", "versionType": "semver"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.14", "versionType": "semver"}], "packageName": "pdns", "programFiles": ["rfc2136handler.cc"], "collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected"}], "datePublic": "2026-04-08T22:00:00.000Z", "references": [{"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.", "supportingMedia": [{"type": "text/html", "value": "<p>A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-04-22T14:00:51.529Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33610", "state": "PUBLISHED", "dateUpdated": "2026-04-22T14:26:32.724Z", "dateReserved": "2026-03-23T12:58:38.267Z", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "datePublished": "2026-04-22T14:00:51.529Z", "assignerShortName": "OX"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected", "modules": ["DNS updates forwarding"], "packageName": "pdns", "product": "Authoritative", "programFiles": ["rfc2136handler.cc"], "repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "versions": [{"lessThan": "5.0.4", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThan": "4.9.14", "status": "affected", "version": "4.9.0", "versionType": "semver"}]}], "source": "security@open-xchange.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*", "matchCriteriaId": "08464BC2-733F-4260-878D-DE05919A7A7D", "versionEndExcluding": "4.9.14", "versionStartIncluding": "4.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*", "matchCriteriaId": "A26C526E-15DC-41BE-9B66-FC6A63679562", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it."}, {"lang": "es", "value": "Un servidor primario malicioso puede causar agotamiento de descriptores de archivo y eventualmente una denegaci\u00f3n de servicio, cuando un servidor secundario de PowerDNS le reenv\u00eda una solicitud de actualizaci\u00f3n de DNS."}], "id": "CVE-2026-33610", "lastModified": "2026-10-26T00:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@open-xchange.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33610", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T14:25:29.036113Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:54.887", "references": [{"source": "security@open-xchange.com", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}], "sourceIdentifier": "security@open-xchange.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.9.0,4.9.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Authoritative", "source": "cna", "vendor": "PowerDNS"}, "product": "authoritative", "vendor": "powerdns"}], "analysis": {"en": {"generated_at": "2026-04-27T08:52:24.881421+00:00", "value": {"mitigation_remediation": ["Apply the latest security patch for PowerDNS Authoritative that fixes the forward\u2011dnsupdate file descriptor handling", "Restrict which primary servers are allowed to send update requests to the secondary, for example by firewall rules or by configuring a whitelist in PowerDNS", "Monitor the secondary server\u2019s file descriptor count and set system limits or alerts to detect sudden exhaustion"], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to PowerDNS Authoritative servers acting as DNS secondaries that forward update requests. No specific product versions are listed, so all current installations of this component should be considered at risk until a patch is applied.", "description_and_impact": "A rogue authoritative DNS server can send specially crafted DNS update requests to a PowerDNS secondary server that forwards them, exhausting the secondary server\u2019s file descriptors. This exhaustion stops the server from opening any additional sockets, leading to an availability loss. The issue is a classic example of an uncontrolled resource consumption flaw (CWE\u2011400).", "risk_and_exploitability": "The CVSS score of 5.9 indicates moderate severity. EPSS information is unavailable, so the current likelihood of exploitation is unclear, but the lack of a KEV listing suggests no known public exploits yet. The likely attack vector is a malicious primary server sending numerous update requests over an open forward\u2011dnsupdate channel, which an attacker could control if the primary is compromised or malicious."}}}}, "created": "2026-04-22T19:15:24.274517+00:00", "updated": "2026-04-27T18:45:11.490023+00:00", "vendors": ["powerdns", "powerdns$PRODUCT$authoritative"]}