CVE-2026-33598: Powerdns Dnsdist

Critical severity, CVSS 9.1. EPSS: 2.8% chance of exploitation in the next 30 days.

A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.

Affected products

• Powerdns Dnsdist: from 1.9.0, before 1.9.13 (fixed in 1.9.13); from 2.0.0, before 2.0.4 (fixed in 2.0.4)

Published 2026-04-22. Last modified 2026-06-17.