PowerDNS Recursor CVE-2026-33262

The attacker must send DNS replies to the target Recursor instance, implying network reachability to the resolver's listening port (typically UDP 53). The reply must be crafted to bypass missing consistency checks in the reply validation logic - specifically, it must trigger a code path where a pointer is dereferenced without prior null-check. The CVSS AC:H indicates special network conditions or reply message characteristics must be present; likely preconditions include: the reply must match an outstanding query (or exploit a race condition), the reply structure must pass initial parsing but fail internal consistency validation, and the timing or network state must be such that the null pointer dereference occurs. Cookies are disabled by default, meaning DNSSEC cookie mechanisms that might block certain reply patterns are absent unless explicitly configured. No authentication is required - any remote network attacker can send DNS replies.

The CVSS 5.9 score with AV:N/AC:H/PR:N/UI:N/A:H indicates a medium-severity denial of service with network accessibility but non-trivial exploitation complexity. The AC:H (attack complexity high) signal is critical - this is not a trivial remote DoS; the attacker must satisfy specific network or timing conditions, or craft replies with precise characteristics. No EPSS score provided, but the presence of vendor patch availability and structured advisory (EUVD-2026-24729) confirms vendor acknowledgment of real impact. The lack of public POC and no KEV status suggests this is not yet widely exploited in the wild, despite being a DoS affecting a critical DNS infrastructure component. For organizations running affected Recursor versions, the real risk depends heavily on network positioning: recursive resolvers exposed to untrusted networks face higher risk than those in controlled environments. The AC:H requirement significantly lowers real-world exploitation probability compared to raw CVSS score alone.

An attacker sends a specially crafted DNS reply to a PowerDNS Recursor instance that lacks proper reply validation. Due to the missing consistency check, the reply causes the Recursor to dereference a null pointer, crashing the process and resulting in temporary denial of service to DNS resolution for that nameserver. The attack requires crafting the reply to match specific network conditions or timing requirements (reflected in CVSS AC:H), making opportunistic exploitation difficult but feasible for a focused attacker.