Skip to content
OpenAdvisories
Medium WID-SEC-2026-1236 6 CVEs

PowerDNS: Mehrere Schwachstellen

Published Apr 22, 2026 · Updated Aug 5, 2026 · Revision 3 · de-DE

Vendor: cPanel Vendor: Debian Product: cPanel/WHM Product: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in PowerDNS ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

Der Domain Name Service (DNS) ermöglicht die Umsetzung der Domainnamen in IP-Adressen. Zur Verhinderung von übermäßigen Anfragen werden die Zuordnungen häufig lokal in einem Cache gespeichert.

Vulnerabilities 6

  • High 7.4
    CVE-2026-33608

    Incomplete domain name sanitization during

    An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual…

    PowerDNS Authoritative pdns pdns Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-33611

    Insufficient validation of HTTPS and SVCB records

    An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

    PowerDNS Authoritative pdns pdns Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2026-33610

    Possible file descriptor exhaustion in forward-dnsupdate

    A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.

    PowerDNS Authoritative pdns pdns Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-33257

    Insufficient input validation of internal webserver

    An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

    PowerDNS Recursor DNSdist Authoritative Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-33260

    Insufficient input validation of internal webserver

    An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

    PowerDNS Recursor DNSdist Authoritative Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2026-33609

    LDAP DN injection

    Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.

    PowerDNS Authoritative pdns pdns Debian Ubuntu Alpine

Revision history

  1. #3

    Neue Updates aufgenommen

  2. #2

    Neue Updates von Debian aufgenommen

  3. #1

    Initiale Fassung

References