CVE-2026-33602 Off-by-one access when processing crafted UDP responses

What is CVE-2026-33602?

CVE-2026-33602 is a medium-severity memory corruption vulnerability in PowerDNS DNSdist, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.

Weakness: CWE-122

Which versions are affected by CVE-2026-33602?

It affects 1 product.

Products include Powerdns Dnsdist.

How do I fix CVE-2026-33602?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-33602 being exploited?

There is no known exploitation of CVE-2026-33602 in the wild and no public exploit code.

Other vulnerabilities in PowerDNS DNSdist

• CVE-2017-7557 Cross-site request forgery in dnsdist High 8.8
• CVE-2026-33593 Denial of service via crafted DNSCrypt query High 7.5
• CVE-2026-24029 DNS over HTTPS ACL bypass Medium 6.5
• CVE-2026-27853 Out-of-bounds write when rewriting large DNS packets Medium 5.9
• CVE-2018-14663 Other in dnsdist Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-33602, GHSA-3hg3-qp28-5p96, UBUNTU-CVE-2026-33602.