CVE-2026-33611: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-33611 is an integer overflow vulnerability in PowerDNS Authoritative Server that allows an authenticated operator with REST API access to produce invalid HTTPS or SVCB DNS record data, leading to LMDB database corruption when the LMDB backend is in use. It affects PowerDNS Authoritative versions 4.9.0 through 4.9.13 and 5.0.0 through 5.0.3. The vulnerability was published on April 22, 2026. CVSS v3.1 scores vary by source: NVD assigns 4.9 (Medium) while the GitHub Advisory Database and ENISA assign 6.5 (Moderate/Medium), with the higher score reflecting both integrity and availability impact (GitHub Advisory, PowerDNS Blog).

The root cause is an integer overflow or wraparound (CWE-190) in the handling of HTTPS and SVCB DNS record data via the REST API. When a privileged operator submits crafted record data through the API, the server fails to properly validate integer boundaries during record construction, resulting in malformed record data being written to the LMDB backend database. The attack vector is network-based, requires high privileges (operator-level REST API access), and no user interaction. No public proof-of-concept code has been identified (GitHub Advisory, PowerDNS Blog).

Successful exploitation can corrupt the LMDB database backend, causing data integrity loss and potential denial of service of the authoritative DNS server. There is no confidentiality impact, but both integrity (malformed DNS records persisted to the database) and availability (service disruption from database corruption) are affected. The impact is limited to deployments using the LMDB backend; installations using other backends (e.g., PostgreSQL, MySQL) are not affected by the database corruption aspect (GitHub Advisory, PowerDNS Blog).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of publication. The EPSS score is approximately 0.005–0.008%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated operator-level access to the REST API, significantly limiting the attack surface (GitHub Advisory, PowerDNS Blog).

1. Obtain REST API access: Acquire operator-level credentials or an API key authorized to use the PowerDNS Authoritative REST API on a target instance running versions 4.9.0–4.9.13 or 5.0.0–5.0.3 with the LMDB backend enabled.
2. Craft malicious DNS record: Construct an HTTP request to the REST API endpoint for creating or modifying DNS records (e.g., POST /api/v1/servers/localhost/zones/{zone}/records), supplying an HTTPS or SVCB record with parameter values designed to trigger an integer overflow in the server's record-building logic.
3. Submit the request: Send the crafted API request to the target server. The server processes the malformed input without adequate bounds checking, producing invalid record data.
4. Trigger LMDB corruption: The invalid record data is written to the LMDB database backend, causing database corruption that may result in service degradation or a denial of service condition for the authoritative DNS server (GitHub Advisory, PowerDNS Blog).

• Network: Unusual REST API requests (POST/PATCH) to PowerDNS API endpoints for HTTPS or SVCB record types from unexpected source IPs or at unusual times.
• Logs: PowerDNS API access logs showing operator-level record modification operations targeting HTTPS (type=HTTPS) or SVCB (type=SVCB) record types; error messages related to LMDB write failures or database integrity errors in the PowerDNS log.
• File System: LMDB database files (pdns.lmdb, pdns.lmdb-lock) showing unexpected modification timestamps or increased size anomalies; LMDB environment errors reported on startup.
• Process: PowerDNS Authoritative process crashes or restarts following REST API record operations; error output referencing LMDB corruption or MDB_CORRUPTED errors.

PowerDNS has released patched versions 4.9.14 and 5.0.4 to address this vulnerability; upgrading to these versions is the recommended remediation (PowerDNS Blog). As a workaround, restrict REST API access to trusted operators only and implement strong authentication and network-level access controls (e.g., firewall rules limiting API port access). Organizations should also maintain regular LMDB database backups and monitor API audit logs for suspicious HTTPS or SVCB record modification activity. Debian and Fedora distribution packages have also been updated to include the fix (Linux Security Debian, Linux Security Fedora).

PowerDNS published a security advisory blog post on April 22, 2026, disclosing the vulnerability and providing patched versions (PowerDNS Blog). The vulnerability was also disclosed on the oss-security mailing list and picked up by standard vulnerability tracking platforms. Downstream Linux distributions including Debian and Fedora issued updated packages shortly after the advisory. No notable independent researcher commentary or significant social media discussion has been identified.