PowerDNS Recursor CVE-2026-33261

The vulnerability requires a zone to be actively transitioning from NSEC to NSEC3 DNSSEC record types during the time the recursor processes queries for that zone. Exploitation depends on network access to the recursive resolver (port 53 UDP/TCP by default) and knowledge or timing of when the target zone is performing NSEC-to-NSEC3 migration. The zone transition condition is the specific prerequisite; resolvers processing static DNSSEC zones with no record type changes are not affected. Attack complexity is elevated because the attacker must either detect or predict the zone transition window and send queries during that narrow timeframe. Non-DNSSEC zones and zones that do not transition between NSEC and NSEC3 are not vulnerable.

CVSS score of 5.9 with network vector (AV:N) but elevated complexity (AC:H) and no authentication required indicates a moderate network-accessible issue with practical exploitation barriers. EPSS or real-world exploitation data is not provided, limiting probabilistic assessment. The requirement for AC:H (high attack complexity) suggests the attacker must trigger a specific condition: a zone transition from NSEC to NSEC3 during active recursion, which may be timing-dependent or require knowledge of target zone configurations. The denial-of-service impact (A:H) is severe for DNS infrastructure but contained within availability (no confidentiality or integrity impact). KEV status unknown - no CISA active exploitation confirmation provided. The combination of moderate CVSS, unknown EPSS, and high attack complexity suggests this is a real vulnerability affecting operational DNS resolvers, but not an immediately weaponizable remote code execution; prioritization should reflect operational criticality of affected recursive resolvers in production networks rather than raw CVSS alone. Organizations running PowerDNS Recursor as a primary resolver should treat this as medium-to-high priority due to patch availability and availability impact.

An attacker sends crafted DNS recursive queries targeting a DNSSEC-signed zone undergoing transition from NSEC to NSEC3 records. When the recursor processes the zone transition during query resolution, the conflicting record type formats trigger an internal consistency check failure, causing the resolver process to become unstable or crash. Repeated queries during or immediately after zone transitions can reliably trigger the denial of service, rendering the recursive resolver unavailable to legitimate clients.