PowerDNS CVE-2026-33257

The internal web server must be explicitly enabled in the PowerDNS configuration (disabled by default). The web server must be network-accessible from the attacker's location; if bound to localhost or a protected management interface only, the vulnerability is not exploitable remotely. No authentication is required to send requests to the vulnerable endpoint. Standard DNS service operation is unaffected if the internal web server is not enabled, making this a critical condition that separates vulnerable from safe deployments.

CVSS 5.3 with network vector (AV:N), low complexity (AC:L), and no privilege requirement (PR:N) indicates straightforward remote exploitation. However, several factors substantially mitigate real-world risk: the internal web server is disabled by default, meaning only deployments that explicitly enable it for management purposes are vulnerable; EPSS exploitation probability is not provided but the low CVSS score and availability of a patch suggest limited weaponization; no public exploit code (POC) or active exploitation (KEV) is indicated, suggesting the threat is primarily theoretical at this time. The asymmetry between CVSS (indicating moderate-severity attack surface) and actual deployment risk (gated behind non-default configuration) is typical of denial-of-service vulnerabilities in optional management interfaces. Organizations must assess whether they have enabled the internal web server before treating this as high priority.

An attacker discovers or scans for an exposed PowerDNS internal web server on the network and crafts a series of HTTP requests designed to trigger unbounded memory allocation in the server's request handling code. The attacker sends these requests repeatedly, causing the process to consume all available system memory until the server crashes or becomes unresponsive, disrupting DNS resolution services for downstream clients.