What is the CVSS score of CVE-2026-33611?

CVE-2026-33611 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-33611?

Yes, a patch is available for CVE-2026-33611. Update the affected software to the latest version immediately.

PowerDNS Authoritative CVE-2026-33611

EUVD-2026-24951 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-04-22 security@open-xchange.com

Information Disclosure Integer Overflow Authoritative

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 22, 2026 - 21:23 nvd

Patch available

Apr 22, 2026 - 16:33 EUVD

Analysis Generated

Apr 22, 2026 - 15:03 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 14:22 euvd

EUVD-2026-24951

Analysis Generated

Apr 22, 2026 - 14:22 vuln.today

CVE Published

Apr 22, 2026 - 14:16 nvd

MEDIUM 6.5

DescriptionCVE.org

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

AnalysisAI

PowerDNS Authoritative server allows authenticated REST API operators to inject malformed HTTPS or SVCB record data, corrupting the LMDB backend database and causing service degradation or denial of availability. The vulnerability requires high-privilege REST API access and affects deployments using LMDB as the backend storage engine, with confirmed impact on data integrity and availability.

Technical ContextAI

PowerDNS Authoritative is a DNS nameserver that supports multiple backend storage engines including LMDB (Lightning Memory-Mapped Database), a high-performance key-value store. The vulnerability exists in the REST API's record validation logic when handling HTTPS (type 65) and SVCB (type 64) record types, which are modern DNS record types used for service binding and HTTPS certificate validation. The REST API accepts authenticated requests from operators to create or modify DNS records, but insufficient input validation on these specific record types allows crafted payloads to be written directly to the LMDB database. LMDB's strict data format requirements mean corrupted records can corrupt internal database structures, affecting all subsequent queries. The CWE classification is not specified but the root cause appears related to improper input validation (CWE-20) and insufficient encoding handling for DNS record data.

RemediationAI

Apply the vendor-released security patch from PowerDNS per the advisory at https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html. Specific patched version not provided in input data - verify exact upgrade target in the advisory. As an interim compensating control, restrict REST API access to a minimal set of trusted operators using network-level access controls (firewall rules limiting API endpoints to specific IPs) and disable REST API entirely if not actively used in production. Monitor LMDB database integrity using PowerDNS built-in diagnostics or external database verification tools to detect corruption. Database repairs may be necessary if corruption is detected before patching; consult PowerDNS documentation for LMDB recovery procedures. Mitigating controls reduce attack surface but do not eliminate the vulnerability in unpatched versions.