PowerDNS Recursor CVE-2026-33259

Exploitation requires: (1) An RPZ provider (either compromised, misconfigured, or malicious) configured to feed RPZ data to the target PowerDNS Recursor; (2) The ability to trigger or initiate concurrent AXFR requests from that provider-typically by controlling the provider endpoint or by inducing rapid re-synchronization of zone transfers within the recursor's transfer logic; (3) The recursor must be configured to accept zone transfers from the provider without strict rate-limiting or deduplication of concurrent requests for the same zone. Non-default configurations or deliberate provider misconfiguration are prerequisites-Recursor with default settings against a well-maintained RPZ provider is not affected. No unauthenticated remote exploitation is possible; the attacker must either control the configured RPZ provider or operate within a network position to hijack or interfere with AXFR traffic (unlikely in production environments with secure zone transfer channels). Local administrative access to recursor configuration combined with control of an RPZ provider is the primary realistic attack vector.

CVSS 5.0 with AV:N/AC:H/PR:H indicates network-accessible but difficult-to-exploit conditions requiring high privilege (likely administrator or zone provider control). The AC:H (High complexity) and PR:H (High privilege requirement) substantially reduce real-world exploitability compared to base score alone. EPSS data was not provided for independent exploitation probability assessment. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is referenced-suggesting limited real-world weaponization. However, the attack surface is legitimate: a compromised or malfunctioning RPZ provider (common in enterprise DNS filtering deployments) can trigger the condition without sophisticated exploit engineering. The impact is significant within its scope-denial of service and data inconsistency affecting DNS resolution reliability. Risk is context-dependent: organizations using RPZ feeds from untrusted providers or with inadequate RPZ provider monitoring face elevated risk; those using well-maintained, vendor-provided RPZ sources face lower probability. The denial-of-service and integrity impacts (I:L, A:H) justify patching despite moderate CVSS, particularly for critical recursive resolvers.

An attacker operating or compromising an RPZ provider configured within an organization's PowerDNS Recursor triggers concurrent zone transfers by sending overlapping AXFR requests for the same RPZ zone. Due to lack of synchronization in the recursor's transfer handler, the zone data becomes inconsistent (some lookups return stale or corrupted records), and use-after-free conditions cause the recursor process to crash, interrupting DNS resolution for all downstream clients until manual or automated restart occurs. Repeat cycles of triggered crashes enable sustained denial of service.