CVE-2026-33593

Denial of service via crafted DNSCrypt query

Published Apr 22, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.

Analysis

Technical impact

A client can trigger a divide by zero error in DNSdist, causing the server to crash from a crafted DNSCrypt query. Based on the description, it is inferred that the crash results in a denial of service that affects the availability of the DNS service for all clients. This flaw is classified as CWE‑369, a divide‑by‑zero weakness.

Affected Systems

The vulnerability affects the PowerDNS DNSdist product. No specific version numbers are given in the advisory, so all currently deployed instances of DNSdist may be vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. Based on the description, it is inferred that the exploit requires only the ability to send a crafted DNSCrypt query to the vulnerable DNSdist server, so remote attackers can trigger the crash. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The flaw is not listed in CISA KEV, meaning there is no confirmed exploitation data yet. Nonetheless, the high severity and the inferred remote attack vector make it a significant risk for environments that rely on DNSdist.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

PowerDNS

DNSdist

unaffected

Version	Status	Constraints
`1.9.0`	affected	< 1.9.13
`2.0.0`	affected	< 2.0.4

Configuration 1 [-]

OR	cpe:2.3:a:powerdns:dnsdist::::::::
	cpe:2.3:a:powerdns:dnsdist::::::::

No data.

Vendor Product Versions

Powerdns

Dnsdist

Version	Status	Scheme	Platform
`[1.9.0,1.9.13)`	affected	semver	—
`[2.0.0,2.0.4)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check the PowerDNS DNSdist advisory for the latest patch version and apply the fix as soon as it is available.
If an immediate upgrade is not feasible, consider disabling DNSCrypt support temporarily to prevent the crafted queries from reaching DNSdist.
Monitor DNSdist logs and network traffic for abnormal crash patterns as an early warning of exploitation attempts.

Generated by OpenCVE AI on April 28, 2026 at 08:25 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6235-1	dnsdist security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.381% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html

History

Apr 24, 2026 7:00 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:powerdns:dnsdist::::::::

Apr 22, 2026 7:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Powerdns Powerdns dnsdist
Vendors & Products		Powerdns Powerdns dnsdist

Apr 22, 2026 3:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-369
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 22, 2026 2:15 PM Description updated. Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.
Title		Denial of service via crafted DNSCrypt query
References		https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`