CVE-2026-33593 Denial of service via crafted DNSCrypt query

What is CVE-2026-33593?

CVE-2026-33593 is a high-severity denial of service vulnerability in PowerDNS DNSdist, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.

Weakness: CWE-369

Which versions are affected by CVE-2026-33593?

It affects 1 product.

Products include Powerdns Dnsdist.

How do I fix CVE-2026-33593?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-33593 being exploited?

There is no known exploitation of CVE-2026-33593 in the wild and no public exploit code.

Other vulnerabilities in PowerDNS DNSdist

• CVE-2017-7557 Cross-site request forgery in dnsdist High 8.8
• CVE-2026-33602 Off-by-one access when processing crafted UDP responses Medium 6.5
• CVE-2026-24029 DNS over HTTPS ACL bypass Medium 6.5
• CVE-2026-27853 Out-of-bounds write when rewriting large DNS packets Medium 5.9
• CVE-2018-14663 Other in dnsdist Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-33593, GHSA-x3rg-p4hx-x3wg, UBUNTU-CVE-2026-33593.