Every CVE Search/ Get API key

CVE-2026-33595

DoQ/DoH3 excessive memory allocation

5.3 MediumFix available

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.37%Up 0.4 points since Apr 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

DoQ/DoH3 excessive memory allocation

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

Record
CVE-2026-33595
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-24933 5.3

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

Record
EUVD-2026-24933
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-6482-x4xv-9qvm 5.3

A client can trigger excessive memory allocation by generating a lot of errors responses over a...

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

Record
GHSA-6482-x4xv-9qvm
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
NVD 5.3

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

Record
CVE-2026-33595
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2026-33595 7.5

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

Record
ALPINE-CVE-2026-33595
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 5.3

DoQ/DoH3 excessive memory allocation

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

Record
CVE-2026-33595
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-33595 7.5

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

Record
DEBIAN-CVE-2026-33595
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-33595 5.3

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

Record
UBUNTU-CVE-2026-33595
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10632-1 No score

dnsdist-2.0.5-1.1 on GA media

These are all security issues fixed in the dnsdist-2.0.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10632-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21015-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
openSUSE-SU-2026:21015-1
Updated
2026-11-02
OSVSUSE-SU-2026:22319-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
SUSE-SU-2026:22319-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dnsdist
Alpine:v3.23
 1.9.0 up to 2.0.4-r0
2.0.4-r0
dnsdist
Alpine:v3.24
 1.9.0 up to 2.0.4-r0
2.0.4-r0
dnsdist
Debian:12
 All versions, plus listed versions
1.7.3-21.8.0-11.8.1-11.8.2-11.8.2-2
Show 33 moreShow less
1.8.2-31.8.3-11.8.3-21.8.3-31.9.10-11.9.3-11.9.4-11.9.5-11.9.6-11.9.8-11.9.9-12.0.0-12.0.0-22.0.0-32.0.0-42.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-12.1.0-12.1.0-22.1.1-12.1.2-12.1.3-1
 None known
dnsdist
Debian:13
 before 1.9.14-0+deb13u1, plus listed versions
1.9.10-11.9.10-1+deb13u1
1.9.14-0+deb13u1
dnsdist
Debian:14
 before 2.0.4-1, plus listed versions
1.9.10-12.0.0-12.0.0-22.0.0-32.0.0-4
Show 8 moreShow less
2.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-1
2.0.4-1
dnsdist
SUSE:Linux Enterprise Server 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.0~alpha2-1
 None known
dnsdist
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.0~rc3-11.4.0-11.4.0-1build11.4.0-1build21.4.0-1ubuntu0.1~esm1
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
dnsdist
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.5.1-3build21.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2
 None known
dnsdist
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.8.0-11.8.2-11.8.2-21.8.2-31.8.3-1
Show 4 moreShow less
1.8.3-21.8.3-2build11.8.3-2build21.8.3-2ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:25.10
 All versions, plus listed versions
1.9.8-11.9.10-11.9.10-1ubuntu0.1
 None known
dnsdist
Ubuntu:26.10
 All versions, plus listed versions
2.0.2-1build12.0.5-2ubuntu12.0.5-2ubuntu3
 None known
dnsdist
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.9.10-12.0.1-12.0.2-12.0.2-1build1
 None known
dnsdist
openSUSE:Tumbleweed
 before 2.0.5-1.1
2.0.5-1.1
dnsdist
openSUSE:Leap 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33595 is a medium vulnerability (CVSS 5.3) in Powerdns Dnsdist, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in dnsdist 2.0.4-r0.

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open