Cache Allocation Vulnerability in NSEC(3) Caches Causes Resource Exhaustion

Publication date: 2026-04-22

Last updated on: 2026-04-27

Assigner: Open-Xchange

Description

By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-22

Last Modified

2026-04-27

Generated

2026-07-06

AI Q&A

2026-04-22

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33258

EUVD

EUVD-2026-24721

Affected Vendors & Products

Vendor	Product	Version / Range
powerdns	recursor	From 5.2.0 (inc) to 5.2.9 (exc)
powerdns	recursor	From 5.3.0 (inc) to 5.3.6 (exc)
powerdns	recursor	5.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when an attacker publishes and queries a specially crafted DNS zone, which causes the system to allocate large entries in the negative and aggressive NSEC(3) caches.

Impact Analysis

The impact of this vulnerability is a potential denial of service due to resource exhaustion, as the allocation of large cache entries can degrade system performance or cause crashes.

Hi! I’m here to help you understand CVE-2026-33258. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70