dnsdist CVE-2026-33593

DNSCrypt protocol support must be explicitly enabled in dnsdist configuration - DNSCrypt is not a default DNS protocol and requires specific listener configuration. The vulnerable dnsdist instance must be network-reachable from the attacker's position, typically on UDP port 443 or a custom-configured DNSCrypt port. No authentication, user interaction, or elevated privileges are required (PR:N, UI:N per CVSS vector). The attack succeeds against default DNSCrypt-enabled configurations without requiring specific non-standard settings. Organizations using dnsdist purely for standard DNS (UDP/53), DNS-over-TLS, or DNS-over-HTTPS without DNSCrypt enabled are NOT vulnerable. Attack success is limited only by network access to the DNSCrypt listener port and basic ability to construct DNSCrypt protocol messages.

This vulnerability presents HIGH operational risk for organizations using DNSCrypt-enabled dnsdist deployments despite zero confidentiality or integrity impact. The CVSS 7.5 score accurately reflects the severity: network-accessible (AV:N), trivial to exploit (AC:L), requires no credentials (PR:N), no user interaction (UI:N), and causes complete availability loss (A:H). The attack is highly automatable - attackers can script DNS query generation to repeatedly crash the service. No EPSS score, KEV status, SSVC decision data, or POC availability information is provided in the input, preventing full exploitation probability assessment. However, the technical nature (divide-by-zero in parsing logic) suggests straightforward exploitation once the triggering query structure is identified. PowerDNS security advisory reference indicates vendor awareness and likely patch availability. Real-world impact: dnsdist crashes affect all downstream DNS resolution for dependent services, potentially causing cascading failures in web services, email, authentication systems, and any application relying on DNS. The scope is unchanged (S:U), meaning the vulnerability doesn't escape dnsdist's security boundary, but the availability impact is COMPLETE within that boundary. Organizations NOT using DNSCrypt protocol support face zero risk. Risk prioritization depends on: (1) whether DNSCrypt is enabled in production, (2) exposure of dnsdist to untrusted networks, (3) presence of rate limiting or query validation upstream.

An attacker identifies a public-facing dnsdist instance with DNSCrypt enabled through DNS service fingerprinting or configuration reconnaissance. The attacker crafts a malicious DNSCrypt query with parameters designed to trigger divide-by-zero in dnsdist's query parsing logic, then sends this query to the dnsdist service on UDP port 443 or the configured DNSCrypt port. The dnsdist process crashes immediately upon parsing the malformed query, causing complete DNS resolution failure for all downstream clients until the service restarts. The attacker can automate repeated crash cycles to maintain persistent denial of service.