CVE-2026-33259

Summary

Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.

Affected Software

VendorProductVersion RangeStatus
PowerDNSRecursor5.4.0 < 5.4.1affected
PowerDNSRecursor5.3.0 < 5.3.6affected
PowerDNSRecursor5.2.0 < 5.2.9affected

Weaknesses

  • Use After Free

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References