CVE-2026-33259 MEDIUM

CVE-2026-33259: Concurrent modification of RPZ data can lead to denial of servce

Vendor Powerdns
Product Recursor
Published April 22, 2026
Last update April 22, 2026
View on NVD All CVEs

CVSS base score

5.0/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.

Key dates

02Disclosure timeline

April 22, 2026 CVE published
April 22, 2026 Record updated