{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33258", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2026-03-18T10:06:16.572Z", "datePublished": "2026-04-22T09:38:19.312Z", "dateUpdated": "2026-04-22T09:38:19.312Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-04-22T09:38:19.312Z"}, "title": "Crafted zones can cause increased resource usage", "datePublic": "2026-04-21T22:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "affected": [{"vendor": "PowerDNS", "product": "Recursor", "collectionURL": "https://repo.powerdns.com/", "packageName": "pdns-recursor", "repo": "https://github.com/PowerDNS/pdns", "modules": ["Negative cache", "Aggressive use of NSEC cache"], "programFiles": ["aggressive_nsec.cc", "negcache.cc"], "versions": [{"status": "affected", "version": "5.4.0", "lessThan": "5.4.1", "versionType": "semver"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.6", "versionType": "semver"}, {"status": "affected", "version": "5.2.0", "lessThan": "5.2.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.</p>"}]}], "references": [{"url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "credits": [{"lang": "en", "value": "Haruto Kimura (Stella)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches."}], "id": "CVE-2026-33258", "lastModified": "2026-04-22T10:16:51.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@open-xchange.com", "type": "Secondary"}]}, "published": "2026-04-22T10:16:51.460", "references": [{"source": "security@open-xchange.com", "url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html"}], "sourceIdentifier": "security@open-xchange.com", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.0,5.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.3.0,5.3.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.2.0,5.2.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Recursor", "source": "cna", "vendor": "PowerDNS"}, "product": "recursor", "vendor": "powerdns"}], "analysis": {"en": {"generated_at": "2026-04-22T11:22:34.026516+00:00", "value": {"mitigation_remediation": ["Update PowerDNS Recursor to the latest release that contains the fix for this issue.", "Configure the recursor to limit the size of negative or NSEC(3) cache entries, either by setting a hard cap or by adjusting cache time\u2011to\u2011live values.", "Restrict recursive lookups from untrusted zones or enforce query rate limiting to reduce the impact of malicious requests."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects PowerDNS Recursor deployments. No specific version range is listed, so any installation of the recursor that has not applied an update that addresses the issue is potentially impacted.", "description_and_impact": "A crafted domain zone can be published and then queried to trigger the allocation of large entries in the negative and aggressive NSEC(3) caches of a PowerDNS Recursor. The resulting memory consumption and potential slowdown constitute a denial\u2011of\u2011service condition, as the resolver may become memory\u2011bound or significantly slower to respond to legitimate queries. The weakness is a failure to bound cache resource usage, corresponding to the uncontrolled resource consumption category.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available for this entry. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by creating an adversarial zone and making the recursor resolve it, which is a remote achievable scenario given that DNS lookups are typically performed over the network. Successful exploitation would cause resource exhaustion, leading to degraded service or outage of the DNS resolver."}}}}, "created": "2026-04-22T11:30:15.370880+00:00", "updated": "2026-04-22T12:30:16.680172+00:00", "vendors": ["powerdns", "powerdns$PRODUCT$recursor"], "weaknesses": ["CWE-400"]}