Every CVE Search/ Get API key

CVE-2026-33257

Insufficient input validation of internal webserver

5.3 MediumFix available

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.51%Up 0.5 points since Apr 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Insufficient input validation of internal webserver

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Record
CVE-2026-33257
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-24720 5.3

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Record
EUVD-2026-24720
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-p687-4q66-wh3p 5.3

An attacker can send a web request that causes unlimited memory allocation in the internal web...

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Record
GHSA-p687-4q66-wh3p
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
NVD 5.3

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Record
CVE-2026-33257
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2026-33257 7.5

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Record
ALPINE-CVE-2026-33257
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 5.3

Insufficient input validation of internal webserver

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Record
CVE-2026-33257
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-33257 7.5

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Record
DEBIAN-CVE-2026-33257
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-33257 5.3

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Record
UBUNTU-CVE-2026-33257
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10632-1 No score

dnsdist-2.0.5-1.1 on GA media

These are all security issues fixed in the dnsdist-2.0.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10632-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21015-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
openSUSE-SU-2026:21015-1
Updated
2026-11-02
OSVSUSE-SU-2026:22319-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
SUSE-SU-2026:22319-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dnsdist
Alpine:v3.23
 1.9.0 up to 2.0.4-r0
2.0.4-r0
dnsdist
Alpine:v3.24
 1.9.0 up to 2.0.4-r0
2.0.4-r0
pdns
Alpine:v3.23
 before 5.0.4-r0
5.0.4-r0
pdns
Alpine:v3.24
 before 5.0.4-r0
5.0.4-r0
dnsdist
Debian:12
 All versions, plus listed versions
1.7.3-21.8.0-11.8.1-11.8.2-11.8.2-2
Show 33 moreShow less
1.8.2-31.8.3-11.8.3-21.8.3-31.9.10-11.9.3-11.9.4-11.9.5-11.9.6-11.9.8-11.9.9-12.0.0-12.0.0-22.0.0-32.0.0-42.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-12.1.0-12.1.0-22.1.1-12.1.2-12.1.3-1
 None known
dnsdist
Debian:13
 before 1.9.14-0+deb13u1, plus listed versions
1.9.10-11.9.10-1+deb13u1
1.9.14-0+deb13u1
dnsdist
Debian:14
 before 2.0.4-1, plus listed versions
1.9.10-12.0.0-12.0.0-22.0.0-32.0.0-4
Show 8 moreShow less
2.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-1
2.0.4-1
pdns
Debian:12
 All versions, plus listed versions
4.7.3-24.8.0-14.8.0-24.8.1-14.8.1-2
Show 37 moreShow less
4.8.2-14.8.2-24.8.3-14.8.3-24.8.3-34.8.3-44.9.0-14.9.0-24.9.1-14.9.1-24.9.1-34.9.2-14.9.2-24.9.3-14.9.3-24.9.3-34.9.4-14.9.4-24.9.7-15.0.0-15.0.0-25.0.1-15.0.2-15.0.3-15.0.4-15.0.5-15.0.5-25.0.5-35.0.5-45.1.0-15.1.1-15.1.1-25.1.1-35.1.2-15.1.3-15.1.4-15.1.5-1
 None known
pdns
Debian:13
 before 4.9.14-0+deb13u1, plus listed versions
4.9.7-1
4.9.14-0+deb13u1
pdns
Debian:14
 before 5.0.4-1, plus listed versions
4.9.7-15.0.0-15.0.0-25.0.1-15.0.2-15.0.3-1
5.0.4-1
Show 29 moreShow less
Affected packages
PackageAffectedFixed
pdns-recursor
Debian:12
 All versions, plus listed versions
4.8.4-14.8.6-14.8.7-14.8.8-14.8.8-1+deb12u1
Show 45 moreShow less
4.9.0-14.9.0-24.9.1-14.9.1-24.9.1-34.9.1-44.9.2-14.9.2-24.9.3-14.9.4-14.9.5-15.0.5-15.0.7-15.0.7-25.0.9-15.1.3-15.1.3-25.2.0-15.2.0-25.2.0-35.2.0-45.2.0-55.2.1-15.2.2-15.2.2-25.2.4-15.2.4-25.2.5-15.3.0-15.3.0-25.3.0-35.3.0-45.3.0-55.3.1-15.3.3-15.3.4-15.3.4-25.3.5-15.4.0-15.4.1-15.4.1-25.4.2-15.4.2-25.4.3-15.4.4-1
 None known
pdns-recursor
Debian:13
 before 5.2.9-0+deb13u1, plus listed versions
5.2.4-25.2.4-2+deb13u15.2.5-15.2.6-0+deb13u15.2.7-0+deb13u15.2.8-0+deb13u1
5.2.9-0+deb13u1
pdns-recursor
Debian:14
 before 5.3.0-1, plus listed versions
5.2.4-25.2.5-1
5.3.0-1
dnsdist
SUSE:Linux Enterprise Server 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.0~alpha2-1
 None known
pdns
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.4.5-1build23.4.6-23.4.6-33.4.7-13.4.7-2
Show 5 moreShow less
4.0.0~alpha1-14.0.0~alpha2-24.0.0~alpha2-34.0.0~alpha2-3build14.0.0~alpha2-3ubuntu0.1~esm1
 None known
pdns-recursor
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1
 None known
dnsdist
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1
 None known
pdns
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.0.4-24.0.4-2build14.0.5-14.1.0-14.1.0-24.1.0-2build14.1.1-14.1.1-1ubuntu0.1~esm1
 None known
pdns-recursor
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.0~rc3-11.4.0-11.4.0-1build11.4.0-1build21.4.0-1ubuntu0.1~esm1
 None known
pdns
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.1.6-3build14.2.0-14.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1
 None known
pdns-recursor
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.5.1-3build21.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2
 None known
pdns
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
4.4.1-1build14.4.1-34.4.1-44.5.2-1build14.5.3-14.5.3-1ubuntu0.1~esm1
 None known
pdns-recursor
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
4.4.2-34.6.0-1ubuntu14.6.0-1ubuntu1+esm1
 None known
pdns
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.8.1-1build14.8.3-24.8.3-2build14.8.3-34.8.3-44.8.3-4build24.8.3-4build3
 None known
pdns-recursor
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.9.0-24.9.1-44.9.2-14.9.2-1build14.9.2-24.9.3-14.9.3-1build24.9.3-1build3
 None known
dnsdist
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.8.0-11.8.2-11.8.2-21.8.2-31.8.3-1
Show 4 moreShow less
1.8.3-21.8.3-2build11.8.3-2build21.8.3-2ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:25.10
 All versions, plus listed versions
1.9.8-11.9.10-11.9.10-1ubuntu0.1
 None known
pdns
Ubuntu:25.10
 All versions, plus listed versions
4.9.4-24.9.7-14.9.7-1build25.0.0-2
 None known
pdns-recursor
Ubuntu:25.10
 All versions, plus listed versions
5.2.0-55.2.2-15.2.2-25.2.4-25.2.4-2build2
 None known
dnsdist
Ubuntu:26.10
 All versions, plus listed versions
2.0.2-1build12.0.5-2ubuntu12.0.5-2ubuntu3
 None known
pdns
Ubuntu:26.10
 All versions, plus listed versions
5.0.2-1build15.0.5-45.1.0-15.1.1-15.1.1-2
Show 4 moreShow less
5.1.1-35.1.2-15.1.3-15.1.4-1
 None known
dnsdist
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.9.10-12.0.1-12.0.2-12.0.2-1build1
 None known
pdns
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.0.0-25.0.1-15.0.2-15.0.2-1build1
 None known
dnsdist
openSUSE:Tumbleweed
 before 2.0.5-1.1
2.0.5-1.1
dnsdist
openSUSE:Leap 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33257 is a medium vulnerability (CVSS 5.3) in Powerdns Authoritative, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in dnsdist 2.0.4-r0.

References

Show 44 moreShow less
This page doesn't list everything

Left out here: 5 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open