CVE-2026-33599Disclosure(powerdns / dnsdist)

LOWCVSS 8.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.

powerdns CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html

Weakness type (CWE)

CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

dnsdist

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

powerdns

Products

dnsdist

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew169d
Disclosure
CVE-2026-33599 A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer o… https://www.cve.org/CVERecord?id=CVE-2026-33599
Post summary
The text provides the CVE abstract, describing how a rogue backend can send a crafted SVCB response via the autoUpgrade Lua option to newServer, but it does not mention a PoC, exploit code, active exploitation, or a patch.
00000137
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds169d
Disclosure
CVE-2026-33599 SVCB Response Injection in PowerDNS Recursor DDR Auto-Upgrade Configuration https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33599
Post summary
The message announces a new CVE (2026‑33599) describing an SVCB response injection vulnerability in PowerDNS Recursor’s DDR auto‑upgrade setting, with a link for further details.
0000057
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	powerdns	dnsdist	-	-	-

Explore more

Back to dashboard powerdns CVEs dnsdist vulnerabilities