PowerDNS CVE-2026-33257

Upgrade to patched versions immediately: dnsdist 1.9.13 or later, 2.0.4 or later; PowerDNS Authoritative 4.9.14 or later, 5.0.4 or later; PowerDNS Recursor 5.2.9 or later, 5.3.6 or later, 5.4.1 or later. If immediate upgrade is not possible, disable the internal web server by removing or commenting out the webserver configuration directive (typically 'webserver=yes' or similar) in the PowerDNS configuration file and restarting the service. This eliminates the attack surface entirely and is the strongest compensating control if the internal web server is not required for operations. If the web server must remain enabled for management purposes, restrict network access to it using firewall rules or bind it to localhost or a protected management network interface only, preventing untrusted networks from reaching it. Consult the specific PowerDNS product documentation (Authoritative, Recursor, or dnsdist) for exact configuration syntax.