PowerDNS Recursor CVE-2026-33256

Exploitation requires that PowerDNS Recursor's internal (built-in) web server be explicitly enabled, which is NOT the default configuration - the vendor states it is disabled by default, so default deployments are not exposed via this vector. Where the web server is enabled and network-reachable, no further prerequisites apply: the CVSS vector is AV:N/AC:L/PR:N/UI:N, meaning a single crafted web request from a remote, unauthenticated attacker is sufficient. The primary limiting factor is therefore operator configuration (web server enabled and its port reachable); there is no user-interaction or authentication requirement once the endpoint is live. Affected branches are Recursor 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0.

Signals are consistent and point to a genuine but conditional availability risk rather than an urgent widespread threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) describes a network-reachable, unauthenticated, low-complexity denial of service with high availability impact and no confidentiality or integrity effect. However, the single most important mitigating fact is in the description: the internal web server is disabled by default, so the network vector only applies to operators who have deliberately enabled that component. The exploitation signals reinforce a low urgency: EPSS is 0.01% (2nd percentile), the CVE is NOT in CISA KEV, and SSVC records Exploitation: none with Technical Impact: partial - though SSVC Automatable: yes indicates that, once a vulnerable endpoint is reachable, triggering it could be scripted at scale. The vuln.today priority is 'this_week', not act_now/emergency. The high CVSS is driven almost entirely by the A:H impact of a DoS on a DNS resolver; the real-world risk is bounded by the non-default configuration requirement. Net: a real patch-worthy issue for anyone exposing the Recursor web server, but low priority for the default-configured majority. No conflicting signals, but note the gap between the 7.5 CVSS and the near-zero EPSS/none-SSVC exploitation status is explained by the default-disabled component.

An operator has enabled PowerDNS Recursor's optional internal web server (API/metrics interface) and exposed it on a reachable network. A remote, unauthenticated attacker sends a crafted web request that drives unbounded memory allocation (CWE-770), exhausting memory and taking the resolver offline. No public exploit code was identified at time of analysis; the available references are vendor and database advisories, not a verified working exploit.