CVE-2026-33259
Concurrent modification of RPZ data can lead to denial of servce
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Concurrent modification of RPZ data can lead to denial of servce
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
- Record
CVE-2026-33259- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2026-24723
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
- Record
EUVD-2026-24723- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6c6h-9v3q-3wqm
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after...
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
- Record
GHSA-6c6h-9v3q-3wqm- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
NVD
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
- Record
CVE-2026-33259- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-33259
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
- Record
ALPINE-CVE-2026-33259- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
OSV
Concurrent modification of RPZ data can lead to denial of servce
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
- Record
CVE-2026-33259- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-12
OSVDEBIAN-CVE-2026-33259
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
- Record
DEBIAN-CVE-2026-33259- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-33259
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
- Record
UBUNTU-CVE-2026-33259- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12532-1No score
pdns-recursor-5.4.8-1.1 on GA media
These are all security issues fixed in the pdns-recursor-5.4.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12532-1- Updated
- 2026-11-12
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorAlpine:v3.23 | before 5.3.6-r0 | 5.3.6-r0 |
pdns-recursorAlpine:v3.24 | before 5.4.1-r0 | 5.4.1-r0 |
pdns-recursorDebian:12 | All versions, plus listed versions 4.8.4-14.8.6-14.8.7-14.8.8-14.8.8-1+deb12u1 Show 45 moreShow less4.9.0-14.9.0-24.9.1-14.9.1-24.9.1-34.9.1-44.9.2-14.9.2-24.9.3-14.9.4-14.9.5-15.0.5-15.0.7-15.0.7-25.0.9-15.1.3-15.1.3-25.2.0-15.2.0-25.2.0-35.2.0-45.2.0-55.2.1-15.2.2-15.2.2-25.2.4-15.2.4-25.2.5-15.3.0-15.3.0-25.3.0-35.3.0-45.3.0-55.3.1-15.3.3-15.3.4-15.3.4-25.3.5-15.4.0-15.4.1-15.4.1-25.4.2-15.4.2-25.4.3-15.4.4-1 | None known |
pdns-recursorDebian:13 | before 5.2.9-0+deb13u1, plus listed versions 5.2.4-25.2.4-2+deb13u15.2.5-15.2.6-0+deb13u15.2.7-0+deb13u15.2.8-0+deb13u1 | 5.2.9-0+deb13u1 |
pdns-recursorDebian:14 | before 5.4.1-1, plus listed versions 5.2.4-25.2.5-15.3.0-15.3.0-25.3.0-3 Show 8 moreShow less5.3.0-45.3.0-55.3.1-15.3.3-15.3.4-15.3.4-25.3.5-15.4.0-1 | 5.4.1-1 |
pdns-recursorUbuntu:Pro:16.04:LTS | All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1 | None known |
pdns-recursorUbuntu:Pro:18.04:LTS | All versions, plus listed versions 4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1 | None known |
pdns-recursorUbuntu:Pro:20.04:LTS | All versions, plus listed versions 4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1 | None known |
pdns-recursorUbuntu:Pro:22.04:LTS | All versions, plus listed versions 4.4.2-34.6.0-1ubuntu14.6.0-1ubuntu1+esm1 | None known |
pdns-recursorUbuntu:24.04:LTS | All versions, plus listed versions 4.9.0-24.9.1-44.9.2-14.9.2-1build14.9.2-24.9.3-14.9.3-1build24.9.3-1build3 | None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorUbuntu:25.10 | All versions, plus listed versions 5.2.0-55.2.2-15.2.2-25.2.4-25.2.4-2build2 | None known |
pdns-recursorUbuntu:26.10 | All versions, plus listed versions 5.3.5-15.4.3-15.4.5-1 | None known |
pdns-recursorUbuntu:26.04:LTS | All versions, plus listed versions 5.2.4-2build25.3.1-15.3.3-15.3.4-15.3.4-1build15.3.4-25.3.5-1 | None known |
pdns-recursoropenSUSE:Tumbleweed From an advisory covering 34 CVEs | before 5.4.8-1.1 | 5.4.8-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| facts | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-33259 is a medium vulnerability (CVSS 5.0) in Powerdns Recursor, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in pdns-recursor 5.3.6-r0.
References
docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html
nvd.nist.gov/vuln/detail/CVE-2026-33259
github.com/advisories/GHSA-6c6h-9v3q-3wqm
security.alpinelinux.org/vuln/CVE-2026-33259
repo.powerdns.com
Show 39 moreShow less
security-tracker.debian.org/tracker/CVE-2026-33259
ubuntu.com/security/CVE-2026-33259
cve.org/CVERecord?id=CVE-2026-33259
suse.com/security/cve/CVE-2025-59023
Left out here: 4 versions. The JSON record has them.