CVE-2026-33611mediumCWE-190

CVE-2026-33611: medium-severity vulnerability in PowerDNS Authoritative

Insufficient validation of HTTPS and SVCB records

Published

Follow this CVE+ Monitor Authoritative+ Monitor pdns

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.4%
An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected products
PowerDNS · Authoritative
Related CVEs — PowerDNS Authoritative

In the same product, most dangerous first.

CVE-2026-42005MEDIUMInsufficient input validation of internal web serverEPSS 0.6%CVE-2026-33260MEDIUMInsufficient input validation of internal webserverEPSS 0.5%CVE-2026-33257MEDIUMInsufficient input validation of internal webserverEPSS 0.5%CVE-2026-33610MEDIUMPossible file descriptor exhaustion in forward-dnsupdateEPSS 0.4%CVE-2026-33608HIGHIncomplete domain name sanitization duringEPSS 0.4%CVE-2026-42001HIGHInsufficient Validation of Autoprimary SOA QueriesEPSS 0.4%