PowerDNS Recursor CVE-2026-33258

The attacker must publish a crafted DNS zone or intercept DNS responses to inject malicious NSEC(3) records. The target Recursor must perform recursive lookups for domains within the attacker's zone, which occurs when a client queries the Recursor for a domain the Recursor does not have cached and must resolve from authoritative servers. No special Recursor configuration is required-the vulnerability affects default recursive configurations. The attack is network-accessible but requires the Recursor to interact with the attacker-controlled zone (direct or via client requests), not entirely passive reconnaissance. Authentication is not required, and the attack works over standard DNS protocols (UDP/TCP port 53). Exploitation is limited by the resolver's overall cache size and memory constraints; very-large-allocation attempts may be detected or self-limited, but incremental attacks are likely effective.

The CVSS 5.3 score reflects a moderate availability impact with minimal complexity: remote unauthenticated access (AV:N/AC:L/PR:N/UI:N) to a network service. However, real-world risk is tempered by several factors. First, the attack requires the resolver to query or receive responses from the attacker-controlled zone, meaning the exploit is not fully passive-the attacker must either control a zone or inject responses. Second, this is a denial-of-service vulnerability affecting service availability but not confidentiality or integrity, limiting business impact. Third, the affected versions are dated (5.2.x, 5.3.x, 5.4.x); organizations running current versions face lower risk. The ENISA EUVD tracking (EUVD-2026-24721) suggests EU-coordinated disclosure, indicating a legitimate research finding with vendor engagement. No EPSS score or CISA KEV status provided, but the availability of a vendor patch and the nature of the attack (memory exhaustion via crafted queries) suggest this is a known, documented issue rather than a 0-day. Organizations running Recursor should prioritize patching as part of routine DNS infrastructure hardening, but this is not a critical emergency-compensating controls (rate limiting, zone query restrictions) can reduce risk until patches are applied.

An attacker controls a DNS zone (or uses DNS response injection) and crafts malicious NSEC(3) records with pathological structure. The attacker then causes the target Recursor to query this zone by sending legitimate DNS queries for domains within it. Each crafted response triggers allocation of a large cache entry in the Recursor's negative or aggressive NSEC(3) cache. By repeating this attack with varying queries, the attacker exhausts heap memory, causing the Recursor process to crash or become unresponsive, disrupting DNS resolution for all clients depending on it.