CVE-2026-33260

moderate-risk

Published 2026-04-22

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Do I need to act?

0.01% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / LOW complexity

Affected Products (4)

Authoritative

Dnsdist

Recursor

Affected Vendors

Powerdns

References (3)

Vendor Advisory https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-20...

Vendor Advisory https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdn...

Vendor Advisory https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-0...

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 10/34 · Low