CVE-2026-33611

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33611
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33611.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33611
Downstream
Published
2026-04-22T14:01:10.135Z
Modified
2026-07-15T01:49:00.789878684Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Insufficient validation of HTTPS and SVCB records
Details

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33611.json",
    "cna_assigner": "OX"
}
References

Affected packages

Git / github.com/powerdns/pdns

Affected ranges

Type
GIT
Repo
https://github.com/powerdns/pdns
Events
Introduced
99d7f7a403baf29714a9f640c24f106c402c5891
Fixed
425110ef9a566eb2763d82f4a90ae4f5d4b6f2d0
Introduced
d1499af06af5dfdff785e9b0595ee692074dba6e
Fixed
b6ee83de58b7354ff1596ac5146facef3efbf9a3
Database specific 
{
    "cpe": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.9.0"
        },
        {
            "fixed": "4.9.14"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.4"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

rec-5.*
rec-5.0.0
rec-5.0.0-rc2
rec-5.0.1
rec-5.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33611.json"