Vulnerability in PowerDNS Affecting DNS Resolution Services

CVE-2026-33599

What is CVE-2026-33599?

A vulnerability exists in PowerDNS's dnsdist that allows a malicious backend to send a maliciously crafted SVCB response to requests made through the Discovery of Designated Resolvers (DDR). This scenario may occur when utilizing the options for autoUpgrade in either Lua or YAML configurations. It's important to note that DDR upgrades are not enabled by default, which adds to the risk when these settings are employed. Administrators should ensure that only trusted backends are configured to safeguard their DNS resolution services.

References