{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33257", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2026-03-18T10:06:16.572Z", "datePublished": "2026-04-22T09:37:59.871Z", "dateUpdated": "2026-04-22T09:37:59.871Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-04-22T09:37:59.871Z"}, "title": "Insufficient input validation of internal webserver", "datePublic": "2026-04-21T22:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "affected": [{"vendor": "PowerDNS", "product": "Authoritative", "collectionURL": "https://repo.powerdns.com/", "packageName": "pdns", "repo": "https://github.com/PowerDNS/pdns", "modules": ["YaHTTP"], "programFiles": ["reqresp.cpp", "reqresp.hpp"], "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.4", "versionType": "semver"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.14", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "PowerDNS", "product": "DNSdist", "collectionURL": "https://repo.powerdns.com/", "packageName": "dnsdist", "repo": "https://github.com/PowerDNS/pdns", "modules": ["YaHTTP"], "programFiles": ["reqresp.cpp", "reqresp.hpp"], "versions": [{"status": "affected", "version": "1.9.0", "lessThan": "1.9.13", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "PowerDNS", "product": "Recursor", "collectionURL": "https://repo.powerdns.com/", "packageName": "pdns-recursor", "repo": "https://github.com/PowerDNS/pdns", "modules": ["YaHTTP"], "programFiles": ["reqresp.cpp", "reqresp.hpp"], "versions": [{"status": "affected", "version": "5.4.0", "lessThan": "5.4.1", "versionType": "semver"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.6", "versionType": "semver"}, {"status": "affected", "version": "5.2.0", "lessThan": "5.2.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.</p>"}]}], "references": [{"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-05.html"}, {"url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html"}, {"url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "credits": [{"lang": "en", "value": "Vitaly Simonovich", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default."}], "id": "CVE-2026-33257", "lastModified": "2026-04-22T10:16:51.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@open-xchange.com", "type": "Secondary"}]}, "published": "2026-04-22T10:16:51.313", "references": [{"source": "security@open-xchange.com", "url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-05.html"}, {"source": "security@open-xchange.com", "url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html"}, {"source": "security@open-xchange.com", "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html"}], "sourceIdentifier": "security@open-xchange.com", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.9.0,4.9.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Authoritative", "source": "cna", "vendor": "PowerDNS"}, "product": "authoritative", "vendor": "powerdns"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.9.0,1.9.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "DNSdist", "source": "cna", "vendor": "PowerDNS"}, "product": "dnsdist", "vendor": "powerdns"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.0,5.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.3.0,5.3.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.2.0,5.2.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Recursor", "source": "cna", "vendor": "PowerDNS"}, "product": "recursor", "vendor": "powerdns"}], "analysis": {"en": {"generated_at": "2026-04-22T11:22:48.386503+00:00", "value": {"mitigation_remediation": ["Disable the internal web server if it is not required for your deployment.", "If the internal web server must remain enabled, configure it to listen only on the localhost interface and restrict access to trusted hosts.", "Update all PowerDNS components to the latest available release that contains the fix, following the vendor\u2019s release notes or advisories."], "summary": {"action": "Disable Web Server", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw is present in PowerDNS Authoritative, DNSdist, and Recursor products. No specific versions are listed in the CNA data, so all publicly available releases that contain the internal web server component may be affected. Because the internal server is disabled by default, the issue only surfaces in installations that explicitly enable it.", "description_and_impact": "The vulnerability originates from insufficient input validation in PowerDNS\u2019s internal web server, which allows an adversary to craft an HTTP request that triggers unbounded memory allocation. The resulting memory exhaustion causes the process to crash or become unresponsive, leading to a Denial\u2011of\u2011Service condition for the DNS service. The flaw is a classic input\u2011validation weakness that permits resource exhaustion.", "risk_and_exploitability": "The CVSS score of 5.3 classifies the vulnerability as moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA\u2019s KEV catalog, suggesting no widespread exploitation has been observed yet. The attack vector is remote via the internal web server; however, since the server is typically bound to localhost, attackers would need network access to the host or a misconfiguration that exposes the endpoint. In the absence of a public exploit, the risk is limited to environments where the internal server is enabled and reachable from untrusted networks."}}}}, "created": "2026-04-22T11:30:15.169921+00:00", "updated": "2026-04-22T11:30:15.371244+00:00", "vendors": ["powerdns", "powerdns$PRODUCT$authoritative", "powerdns$PRODUCT$dnsdist", "powerdns$PRODUCT$recursor"]}