Read the docs
TI-2026-25990 Aliases CVE-2026-33608GHSA-q6jm-wh7h-j4g3

Incomplete domain name sanitization during

Priority MEDIUM 48CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Fixed Authoritative (PowerDNS): 5.0.4, 4.9.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PowerDNSAuthoritative5.0.0 to before 5.0.4; 4.9.0 to before 4.9.145.0.4, 4.9.14Patch availableCNA
  • Authoritative VendorPowerDNS Affected 5.0.0 to before 5.0.4; 4.9.0 to before 4.9.14 Fixed in 5.0.4, 4.9.14 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*4.9.0 to before 4.9.14; 5.0.0 to before 5.0.4VulnerablePowerDNS
  • cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:* Versions 4.9.0 to before 4.9.14; 5.0.0 to before 5.0.4 Vulnerable ·PowerDNS

Remediation

  • Fix · CNA Authoritative (PowerDNS) Fixed in 5.0.4, 4.9.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PowerDNS Authoritative 4.9.14, 5.0.4

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-25677 Insufficient input validation of internal webserverPriority LOW 39
    • TI-2026-25674 Insufficient input validation of internal webserverPriority LOW 39
    • TI-2026-25992 Possible file descriptor exhaustion in forward-dnsupdatePriority LOW 33
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33608
  2. 2026-10-03 Alias added: GHSA-q6jm-wh7h-j4g3

References

Advisory 1

  • TI-2015-01678 The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and… CVSS 2.0HIGH 7.8
  • TI-2016-04703 PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . CVSS 3.0HIGH 7.5
  • TI-2015-04466 PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to… CVSS 2.0MEDIUM 5.0
  • TI-2016-04702 PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a… CVSS 3.0HIGH 7.5
  • TI-2020-15157 An issue was discovered in PowerDNS Authoritative through 4.3.0 when… CVSS 3.1CRITICAL 9.8
  • TI-2015-04604 The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before… CVSS 2.0HIGH 7.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences