CVE-2026-33611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33611", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2026-03-23T12:58:38.267Z", "datePublished": "2026-04-22T14:01:10.135Z", "dateUpdated": "2026-04-22T14:24:57.121Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-04-22T14:01:10.135Z"}, "title": "Insufficient validation of HTTPS and SVCB records", "datePublic": "2026-04-08T22:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Overflow or Wraparound", "type": "CWE"}]}], "affected": [{"vendor": "PowerDNS", "product": "Authoritative", "collectionURL": "https://repo.powerdns.com/", "packageName": "pdns", "repo": "https://github.com/PowerDNS/pdns", "modules": ["SVCB/ALPN parsing"], "programFiles": ["dnswriter.cc", "rcpgenerator.cc"], "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.4", "versionType": "semver"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.</p>"}]}], "references": [{"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Tibs", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T14:24:04.530345Z", "id": "CVE-2026-33611", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:24:57.121Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33611", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T14:24:04.530345Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T14:24:08.362Z"}}], "cna": {"title": "Insufficient validation of HTTPS and SVCB records", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Tibs"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "modules": ["SVCB/ALPN parsing"], "product": "Authoritative", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.4", "versionType": "semver"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.14", "versionType": "semver"}], "packageName": "pdns", "programFiles": ["dnswriter.cc", "rcpgenerator.cc"], "collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected"}], "datePublic": "2026-04-08T22:00:00.000Z", "references": [{"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.", "supportingMedia": [{"type": "text/html", "value": "<p>An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-04-22T14:01:10.135Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33611", "state": "PUBLISHED", "dateUpdated": "2026-04-22T14:24:57.121Z", "dateReserved": "2026-03-23T12:58:38.267Z", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "datePublished": "2026-04-22T14:01:10.135Z", "assignerShortName": "OX"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected", "modules": ["SVCB/ALPN parsing"], "packageName": "pdns", "product": "Authoritative", "programFiles": ["dnswriter.cc", "rcpgenerator.cc"], "repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "versions": [{"lessThan": "5.0.4", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThan": "4.9.14", "status": "affected", "version": "4.9.0", "versionType": "semver"}]}], "source": "security@open-xchange.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*", "matchCriteriaId": "08464BC2-733F-4260-878D-DE05919A7A7D", "versionEndExcluding": "4.9.14", "versionStartIncluding": "4.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*", "matchCriteriaId": "A26C526E-15DC-41BE-9B66-FC6A63679562", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend."}, {"lang": "es", "value": "Un operador autorizado a usar la API REST puede causar que el servidor autoritativo produzca datos de registro HTTPS o SVCB no v\u00e1lidos, lo que a su vez puede causar corrupci\u00f3n de la base de datos LMDB, si se utiliza el backend LMDB."}], "id": "CVE-2026-33611", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "security@open-xchange.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33611", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T14:24:04.530345Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:55.000", "references": [{"source": "security@open-xchange.com", "tags": ["Broken Link"], "url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}], "sourceIdentifier": "security@open-xchange.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.9.0,4.9.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Authoritative", "source": "cna", "vendor": "PowerDNS"}, "product": "authoritative", "vendor": "powerdns"}], "analysis": {"en": {"generated_at": "2026-04-27T08:52:10.112497+00:00", "value": {"mitigation_remediation": ["Apply the latest available patch or upgrade to a version of PowerDNS Authoritative that contains the validation fix.", "Restrict REST API access to trusted administrators and enforce strong authentication to prevent unintended use of the API.", "If feasible, move the database away from the LMDB backend or implement regular integrity checks and backups to detect and recover from corruption.", "Monitor PowerDNS logs for errors during HTTPS or SVCB record creation and investigate any suspicious activity."], "summary": {"action": "Apply Patch", "impact": "Database corruption leading to service disruption"}, "threat_synthesis": {"affected_systems": "The affected product is PowerDNS Authoritative. The advisory does not list specific vulnerable versions, so any instance that uses the REST API and employs the LMDB backend is considered susceptible.", "description_and_impact": "An operator who can invoke the REST API on PowerDNS Authoritative can trigger the creation of malformed HTTPS or SVCB records. The insufficient validation of these record types can cause the internal LMDB database to be corrupted, which destroys data integrity and potentially stops the DNS service from responding correctly. The flaw is a manifestation of CWE\u2011190, an integer over\u2011 or under\u2011flow built into the record parsing logic.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploit activity. The likely attack vector requires an authenticated user with REST API privileges; operators or compromised accounts could invoke the vulnerable API endpoint to induce database corruption."}}}}, "created": "2026-04-22T20:15:20.259267+00:00", "updated": "2026-04-27T18:45:11.489398+00:00", "vendors": ["powerdns", "powerdns$PRODUCT$authoritative"]}