CVE-2026-33261

Null pointer accces in aggressive NSEC(3) cache

5.9 MediumFix available

CVE-2026-33261 is a medium vulnerability (CVSS 5.9) in Powerdns Recursor, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in pdns-recursor 5.3.6-r0.

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.24%Up 0.2 points since Apr 22, 2026

What each source reports

CVE List Score used 5.9

Null pointer accces in aggressive NSEC(3) cache

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

Record: CVE-2026-33261
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-353
Updated: 2026-11-02

EUVDEUVD-2026-24727 5.9

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

Record: EUVD-2026-24727
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rq6v-8q98-rrj8 5.9

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial...

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

Record: GHSA-rq6v-8q98-rrj8
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-353
Updated: 2026-11-02

NVD 5.9

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

Record: CVE-2026-33261
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-353
Updated: 2026-11-02

OSVALPINE-CVE-2026-33261 5.9

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

Record: ALPINE-CVE-2026-33261
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 5.9

Null pointer accces in aggressive NSEC(3) cache

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

Record: CVE-2026-33261
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-33261 5.9

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

Record: DEBIAN-CVE-2026-33261
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-33261 5.9

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

Record: UBUNTU-CVE-2026-33261
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

powerdns recursor

Affected packages

Affected packages
Package	Affected	Fixed
`pdns-recursor` Alpine:v3.23	before 5.3.6-r0	5.3.6-r0
`pdns-recursor` Alpine:v3.24	before 5.4.1-r0	5.4.1-r0
`pdns-recursor` Debian:12	All versions, plus listed versions 4.8.4-14.8.6-14.8.7-14.8.8-14.8.8-1+deb12u1 Show 45 moreShow less 4.9.0-14.9.0-24.9.1-14.9.1-24.9.1-34.9.1-44.9.2-14.9.2-24.9.3-14.9.4-14.9.5-15.0.5-15.0.7-15.0.7-25.0.9-15.1.3-15.1.3-25.2.0-15.2.0-25.2.0-35.2.0-45.2.0-55.2.1-15.2.2-15.2.2-25.2.4-15.2.4-25.2.5-15.3.0-15.3.0-25.3.0-35.3.0-45.3.0-55.3.1-15.3.3-15.3.4-15.3.4-25.3.5-15.4.0-15.4.1-15.4.1-25.4.2-15.4.2-25.4.3-15.4.4-1	None known
`pdns-recursor` Debian:13	before 5.2.9-0+deb13u1, plus listed versions 5.2.4-25.2.4-2+deb13u15.2.5-15.2.6-0+deb13u15.2.7-0+deb13u15.2.8-0+deb13u1	5.2.9-0+deb13u1
`pdns-recursor` Debian:14	before 5.4.1-1, plus listed versions 5.2.4-25.2.5-15.3.0-15.3.0-25.3.0-3 Show 8 moreShow less 5.3.0-45.3.0-55.3.1-15.3.3-15.3.4-15.3.4-25.3.5-15.4.0-1	5.4.1-1
`pdns-recursor` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1	None known
`pdns-recursor` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1	None known
`pdns-recursor` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1	None known
`pdns-recursor` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 4.4.2-34.6.0-1ubuntu14.6.0-1ubuntu1+esm1	None known
`pdns-recursor` Ubuntu:24.04:LTS	All versions, plus listed versions 4.9.0-24.9.1-44.9.2-14.9.2-1build14.9.2-24.9.3-14.9.3-1build24.9.3-1build3	None known
`pdns-recursor` Ubuntu:25.10	All versions, plus listed versions 5.2.0-55.2.2-15.2.2-25.2.4-25.2.4-2build2	None known
`pdns-recursor` Ubuntu:26.10	All versions, plus listed versions 5.3.5-15.4.3-15.4.5-1	None known
`pdns-recursor` Ubuntu:26.04:LTS	All versions, plus listed versions 5.2.4-2build25.3.1-15.3.3-15.3.4-15.3.4-1build15.3.4-25.3.5-1	None known

History

History
When	Changed	Sources
2026-11-03	affected, aliases, references	OSV
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less

This page doesn't list everything

Left out here: 5 versions. The JSON record has them.