CVE-2026-33601
Null Pointer Dereference in zoneToCache Causes DoS in DNS Server
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: Open-Xchange
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| powerdns | recursor | From 5.2.0 (inc) to 5.2.9 (exc) |
| powerdns | recursor | From 5.3.0 (inc) to 5.3.6 (exc) |
| powerdns | recursor | 5.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when the zoneToCache function interacts with a malicious authoritative server. The attacker can send a specially crafted zone that causes a null pointer dereference due to a missing consistency check in the function.
This flaw leads to a denial of service condition, meaning the affected system or application can crash or become unavailable.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service (DoS). An attacker exploiting this issue can cause the affected system to crash or become unresponsive, disrupting normal operations.