CVE-2026-33599 Out-of-bounds read in service discovery

What is CVE-2026-33599?

CVE-2026-33599 is a low-severity vulnerability in PowerDNS DNSdist, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.

Weakness: CWE-125

Which versions are affected by CVE-2026-33599?

It affects 1 product.

Products include Powerdns Dnsdist.

How do I fix CVE-2026-33599?

Apply the vendor's patch.

Is CVE-2026-33599 being exploited?

There is no known exploitation of CVE-2026-33599 in the wild and no public exploit code.

Other vulnerabilities in PowerDNS DNSdist

• CVE-2017-7557 Cross-site request forgery in dnsdist High 8.8
• CVE-2026-33593 Denial of service via crafted DNSCrypt query High 7.5
• CVE-2026-33602 Off-by-one access when processing crafted UDP responses Medium 6.5
• CVE-2026-24029 DNS over HTTPS ACL bypass Medium 6.5
• CVE-2026-27853 Out-of-bounds write when rewriting large DNS packets Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-33599, GHSA-8fg9-fg58-x78h, UBUNTU-CVE-2026-33599.