PowerDNS CVE-2026-33260

The internal web server must be explicitly enabled in the PowerDNS configuration. This requires the administrator to have set configuration parameters such as 'webserver=yes' (Authoritative/Recursor) or corresponding dnsdist configuration directives, which are disabled by default. Additionally, the attacker must have network-level access to the web server listening port and address (typically 127.0.0.1:8081 or a similarly configured endpoint). If the web server is bound to localhost only, exploitation is restricted to local network segments or compromised systems within the same network. If bound to 0.0.0.0 or a public interface, remote exploitation is possible. The vulnerability does not require authentication tokens, API keys, or user interaction - any HTTP client capable of reaching the web server port can craft the malicious request.

CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates unauthenticated remote access with no special conditions, yielding a network-exploitable DoS. However, real-world risk is substantially mitigated by the critical fact that the internal web server is disabled by default - an attacker must either have influence over the target's configuration or the administrator must have deliberately enabled the feature. EPSS score data is not provided, preventing quantitative exploitation probability assessment. No KEV status or POC availability is indicated in the input, suggesting this is not yet confirmed as actively exploited or widely leveraged. The low CVSS score (5.3) combined with the default-disabled attack surface indicates this is a medium-priority issue for organizations running PowerDNS with the internal web server explicitly enabled (e.g., for monitoring, statistics collection, or API access). For the vast majority of default deployments, practical risk is low. The severity should be reassessed upward for environments where the web server is intentionally exposed.

An attacker discovers that a target network runs PowerDNS Recursor 5.3.2 with the internal web server enabled for statistics collection. The attacker sends a crafted HTTP GET or POST request to the web server port (e.g., http://target:8081/) that triggers unbounded memory allocation within the request handler. Within seconds, the Recursor process consumes all available system memory, causing the process to hang or crash and stopping DNS resolution for all downstream clients. The attacker can repeat this attack to maintain service disruption without authentication or complex exploitation steps.