PowerDNS Recursor CVE-2026-33600

Exploitation requires three specific conditions: (1) RPZ functionality must be enabled and configured in the target Recursor instance; (2) the malicious response must originate from an authoritative server that the Recursor is configured to query for RPZ data (typically specified via 'rpzMaster' or similar configuration directive); (3) the attacker must craft an RPZ response with the specific malformed structure that bypasses the current (pre-patch) consistency check and triggers the null pointer. Default Recursor installations may not have RPZ enabled, reducing the population at risk. Recursor version is a limiting factor-versions 5.2.9+, 5.3.6+, or 5.4.1+ include the protective consistency check and are not vulnerable.

CVSS 4.4 with AV:N/AC:H/PR:H indicates moderate but constrained risk. The network vector (AV:N) allows remote exploitation, but multiple protective factors limit real-world impact: high complexity (AC:H) suggests the attacker must craft a precise RPZ payload; high privilege requirement (PR:H) means the attacker must control an authoritative nameserver that the Recursor actually queries for RPZ data-not a random internet host. The impact is availability only (A:H), not confidentiality or integrity. EPSS score not provided; exploitation probability appears low due to AC:H and PR:H constraints. No KEV or POC data supplied, suggesting no confirmed active exploitation at time of analysis. This is a real DoS vector against Recursor instances that rely on external RPZ sources, but requires active attacker setup (malicious authoritative server) rather than passive network proximity. Risk is elevated only in environments where RPZ is enabled and threat model includes compromised or malicious authoritative nameservers.

An attacker who operates or compromises an authoritative DNS server that hosts an RPZ zone monitored by a target Recursor instance crafts a malicious RPZ response containing inconsistent or malformed data that triggers the null pointer dereference. When the Recursor queries the authoritative server for RPZ updates (a normal operational behavior), it processes the crafted response and crashes due to the missing validation check, resulting in brief service unavailability. The attack requires the attacker to know or infer which nameserver the Recursor uses for its RPZ data and have control over that nameserver.