PowerDNS Authoritative CVE-2026-33610

Exploitation requires the target to run PowerDNS Authoritative as a SECONDARY configured to forward DNS UPDATE requests to a primary (DNS update forwarding enabled - not a default posture), AND the attacker to control or impersonate that primary server (the 'rogue primary'). The limiting factors are therefore: the update-forwarding feature must be active, and the attacker must occupy the primary role that the secondary already trusts/forwards to, which bounds exploitation to specific deployment topologies rather than any internet-facing PowerDNS instance. Only availability is affected (no data disclosure or modification); only versions 5.0.0-5.0.3 and 4.9.0-4.9.13 are vulnerable.

Signals point to a genuine but conditional availability risk rather than a broadly urgent one. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, no-privilege, availability-only impact, which raises the paper severity. However, that network/no-privilege framing reflects that the malicious party is a rogue PRIMARY server; actual exploitation depends on the target PowerDNS secondary being configured to forward DNS UPDATE requests to that primary, so the real-world reach is narrower than AV:N/PR:N alone suggests. The other signals all point lower: EPSS is 0.02% (4th percentile), SSVC reports Exploitation: none and Automatable: no with only partial technical impact, there is no CISA KEV listing, and no public exploit code is referenced. These are consistent with each other, not conflicting - low exploitation probability aligns with the no-KEV, automatable:no picture. The vuln.today priority of this_week and the confidentiality/integrity impact of none (A:H only) frame this as a prompt-but-scheduled patch for affected deployments rather than an emergency: a real priority for operators running secondaries that forward updates, and lower priority for everyone else.

An operator runs a PowerDNS Authoritative secondary configured to forward DNS UPDATE requests to its primary. An attacker who controls (or impersonates) that primary responds in a way that causes the secondary to leak/exhaust file descriptors on each forwarded update, until the secondary runs out and stops serving. No public exploit code is referenced; this is an availability-only denial of service with no code execution.