PowerDNS Authoritative CVE-2026-33608

Exploitation requires the target PowerDNS Authoritative Server to be configured with the bind backend enabled for zone storage and management. The server must accept DNS NOTIFY requests from the attacker's source address, meaning either no allow-notify-from restrictions are configured or the attacker can spoof trusted primary nameserver addresses. High attack complexity (AC:H) suggests additional prerequisites such as specific timing conditions, race conditions in configuration updates, or precise knowledge of the bind backend's configuration file format and validation weaknesses. The vulnerability does not require authentication (PR:N) or user interaction (UI:N), allowing remote exploitation once the configuration prerequisites are met. Successful exploitation depends on the server eventually restarting, as the corrupted configuration only triggers failure during service initialization rather than runtime.

The CVSS v3.1 score of 7.4 (High severity) reflects the network attack vector (AV:N) and lack of authentication requirements (PR:N), balanced against high attack complexity (AC:H) and no user interaction needed (UI:N). The vulnerability enables both integrity compromise (I:H) through configuration corruption and availability impact (A:H) via service disruption, though no confidentiality breach (C:N). Attack complexity is rated high, suggesting exploitation requires precise timing, specific backend configuration (bind backend must be active), or manipulation of DNS protocol timing windows. CISA KEV status is not present, indicating no confirmed active exploitation in the wild. EPSS data is not provided, limiting probabilistic risk assessment. The persistent denial of service requiring manual remediation distinguishes this from transient DoS vulnerabilities - successful exploitation creates operational burden beyond simple service restart. Real-world risk is elevated for authoritative DNS servers using the bind backend in internet-facing roles, particularly those accepting NOTIFY requests from untrusted sources. Organizations not using the bind backend or those with strict NOTIFY ACLs face minimal exposure. The requirement for manual intervention to restore service significantly amplifies operational impact compared to self-recovering vulnerabilities.

An attacker identifies an internet-facing PowerDNS Authoritative Server running the bind backend by fingerprinting DNS responses or scanning for common deployment patterns. The attacker crafts a malicious DNS NOTIFY packet with carefully constructed zone information designed to pass initial parsing but create invalid bind backend configuration syntax. Upon receiving the NOTIFY, PowerDNS processes the request and updates the bind backend configuration file with the malformed zone definition. The corrupted configuration remains dormant until the next scheduled restart or administrator-initiated service reload, at which point PowerDNS fails to start due to configuration validation errors, creating persistent denial of service until operations staff manually edit the configuration to remove the injected entries.