CVE-2026-33601

Received Received - Intake

Null Pointer Dereference in zoneToCache Causes DoS in DNS Server

Publication date: 2026-04-22

Last updated on: 2026-04-27

Assigner: Open-Xchange

Description

If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-22

Last Modified

2026-04-27

Generated

2026-07-06

AI Q&A

2026-04-23

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33601

EUVD

EUVD-2026-24733

Affected Vendors & Products

Vendor	Product	Version / Range
powerdns	recursor	From 5.2.0 (inc) to 5.2.9 (exc)
powerdns	recursor	From 5.3.0 (inc) to 5.3.6 (exc)
powerdns	recursor	5.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when the zoneToCache function interacts with a malicious authoritative server. The attacker can send a specially crafted zone that causes a null pointer dereference due to a missing consistency check in the function.

This flaw leads to a denial of service condition, meaning the affected system or application can crash or become unavailable.

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS). An attacker exploiting this issue can cause the affected system to crash or become unresponsive, disrupting normal operations.

Hi! I’m here to help you understand CVE-2026-33601. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70