dnsdist CVE-2026-33593

Apply the vendor-released patch referenced in PowerDNS security advisory 2026-04 available at https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html. The advisory should specify fixed dnsdist versions and upgrade procedures. Until patching is complete, disable DNSCrypt protocol support in dnsdist configuration if this feature is not operationally required - this completely eliminates the attack surface since the vulnerability is specific to DNSCrypt query parsing. For environments requiring DNSCrypt, implement upstream query validation or rate limiting on DNS traffic sources to reduce attack surface and enable faster detection of exploitation attempts through monitoring for repeated dnsdist process crashes. Deploy dnsdist behind load balancers with automatic failover and health checking to minimize service disruption if exploitation occurs. Note that disabling DNSCrypt affects clients expecting encrypted DNS, requiring communication with end users or migration to alternative encrypted DNS protocols like DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT).