PowerDNS Recursor CVE-2026-33601

The zoneToCache function must be active and processing zone data from an upstream authoritative server. The attacker must be able to respond as an authoritative server for a zone that the Recursor queries, or intercept and modify the Recursor's upstream DNS queries in transit. The Recursor must accept and cache zone data from this source without additional validation. High privilege requirement in CVSS (PR:H) suggests the attacker may need to influence the Recursor's configuration to query the malicious authority, or the Recursor must be in a network position where it queries untrusted authorities by default. Exploitation requires high attack complexity (AC:H), indicating the attacker must craft the zone response in a specific way to reliably trigger the null pointer dereference - generic malformed zones may not suffice.

CVSS 4.4 with AV:N/AC:H/PR:H indicates moderate severity tempered by significant attack constraints. Network accessibility is available, but attack complexity is high and requires high privileges, limiting real-world exploitation. The CVSS vector explicitly denies confidentiality and integrity impact, limiting damage to denial of service only. No KEV listing or POC availability confirmed in provided data, suggesting limited active exploitation. The high privilege requirement (PR:H) is atypical for DNS resolver attacks and warrants clarification - this may indicate the attacker must have administrative access to the Recursor configuration or network path, not merely network access. The practical risk depends on whether Recursor instances are exposed to untrusted authoritative servers or if attackers can achieve network position to respond as authoritative. For organizations running Recursor with restricted upstream server lists, risk is lower; for those accepting responses from arbitrary nameservers or in untrusted network environments, risk is moderate. The availability-only impact and non-default conditions suggest this is a lower priority than remote code execution vulnerabilities but warrants patching during maintenance windows.

An attacker operates or compromises an authoritative DNS server that the target PowerDNS Recursor has been configured to query or can reach through DNS resolution. When the Recursor queries this malicious authority for zone data, the attacker responds with a crafted zone containing invalid or inconsistent records that bypass the missing consistency check. The zoneToCache function processes the zone, triggering a null pointer dereference that crashes the Recursor process, disrupting DNS resolution service for all downstream clients depending on it.