CVE-2026-33596 TCP backend stream ID overflow

Low 3.1 Published 22 Apr 2026 Updated 22 Apr 2026

An attacker can cause query-response mismatches or service disruption in PowerDNS DNSdist by exploiting a stream ID overflow via timed queries.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-33596?

CVE-2026-33596 is a low-severity vulnerability in PowerDNS DNSdist, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend.

Weakness: CWE-190

Which versions are affected by CVE-2026-33596?

It affects 1 product.

Products include Powerdns Dnsdist.

How do I fix CVE-2026-33596?

Apply the vendor's patch.

Is CVE-2026-33596 being exploited?

There is no known exploitation of CVE-2026-33596 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-33596, GHSA-jcpx-7c75-g6c9, UBUNTU-CVE-2026-33596.