CVE-2026-33261
Denial of Service via NSEC to NSEC3 Zone Transition in DNS
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: Open-Xchange
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| powerdns | recursor | From 5.2.0 (inc) to 5.2.9 (exc) |
| powerdns | recursor | From 5.3.0 (inc) to 5.3.6 (exc) |
| powerdns | recursor | 5.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-353 | The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when there is a zone transition from NSEC to NSEC3 in a DNS system, which might trigger an internal inconsistency.
This inconsistency can cause a denial of service, meaning the affected system or service could become unavailable or stop functioning properly.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service (DoS).
An attacker could exploit the zone transition inconsistency to disrupt the availability of the affected DNS service, potentially causing interruptions in network or application access.