CVE-2026-33258: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-33258 is a denial-of-service vulnerability in PowerDNS Recursor caused by unbounded resource allocation in the negative and aggressive NSEC(3) caches. By publishing and querying a specially crafted DNS zone, an unauthenticated remote attacker can trigger allocation of large cache entries, leading to memory exhaustion. Affected versions include PowerDNS Recursor 5.2.0–5.2.8, 5.3.0–5.3.5, and 5.4.0. The vulnerability was disclosed on April 22, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, and 5.3 (Medium) per ENISA/GitHub Advisory (GitHub Advisory, PowerDNS Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). PowerDNS Recursor's negative cache and aggressive NSEC(3) cache — used to optimize DNS resolution by storing denial-of-existence responses — fail to impose adequate size restrictions on entries derived from crafted zone data. An attacker who controls a DNS zone can publish specially crafted records and then query the Recursor for names within that zone, causing the Recursor to populate its caches with abnormally large entries. No authentication or special privileges are required; only network access to the Recursor is needed (GitHub Advisory, PowerDNS Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial-of-service condition through memory exhaustion on the affected PowerDNS Recursor instance. As the Recursor's caches grow unboundedly, system resources are consumed, degrading or completely disabling DNS recursion services for all clients relying on the affected instance. There is no impact on confidentiality or integrity; the attack is limited to availability (GitHub Advisory, PowerDNS Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or network-accessible PowerDNS Recursor instances running versions 5.2.0–5.2.8, 5.3.0–5.3.5, or 5.4.0 using network scanning tools or DNS banner queries.
2. Register a malicious DNS zone: The attacker registers or controls an authoritative DNS zone and publishes crafted NSEC or NSEC3 records designed to produce abnormally large negative cache entries when queried.
3. Trigger cache population: Send repeated DNS queries to the target Recursor for names within the crafted zone. The Recursor resolves these queries against the attacker-controlled authoritative server and caches the oversized negative/NSEC(3) responses.
4. Exhaust resources: Continue querying to cause progressive memory growth in the Recursor's negative and aggressive NSEC(3) caches, eventually exhausting system memory and causing denial of service for legitimate DNS clients (PowerDNS Advisory, Red Hat Bugzilla).

• Network: Unusual volume of DNS queries from external sources targeting names within a single or small set of zones; repeated queries for non-existent names (NXDOMAIN patterns) from the same source IP.
• Logs: PowerDNS Recursor logs showing high rates of NSEC/NSEC3 cache insertions; repeated resolution attempts for names in an unfamiliar or newly registered zone.
• System Resources: Abnormal and sustained growth in memory consumption by the pdns_recursor process; system alerts for high memory utilization or OOM (out-of-memory) events on the Recursor host.
• Process: pdns_recursor process becoming unresponsive or crashing; increased swap usage correlated with DNS query spikes (PowerDNS Advisory).

PowerDNS has released patched versions addressing this vulnerability: upgrade to 5.2.9 or later (5.2.x series), 5.3.6 or later (5.3.x series), or 5.4.1 or later (5.4.x series). As interim mitigations, administrators should implement rate limiting on DNS recursive queries, restrict recursive DNS services to authorized clients only (e.g., via ACLs), and monitor system resource utilization on Recursor instances for signs of memory exhaustion. Upgrading to a patched version is the recommended long-term solution (PowerDNS Advisory, Red Hat Bugzilla).

PowerDNS published a security advisory and blog post on April 22, 2026, the same day the CVE was disclosed, indicating coordinated disclosure and prompt vendor response (PowerDNS Blog). Red Hat tracked the issue as high severity in their Bugzilla system, and the vulnerability was also reported to the oss-security mailing list (oss-sec). Debian subsequently issued a security advisory (DSA-6234-1) for the pdns-recursor package, and Tenable released detection plugins for the vulnerability (Tenable). Community reaction has been measured, consistent with the low exploitation risk and prompt patch availability.