CVE-2026-33609

LDAP DN injection

View on CVE.org
Published Apr 22, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.

Analysis

AI-generated

Technical impact

The flaw is an LDAP Distinguished Name injection caused by incomplete escaping of LDAP queries when the server is configured with 8bit-dns enabled. An attacker can craft DNS requests that manipulate the LDAP query string and retrieve information from internal domain subtrees that would normally be inaccessible. The result is unintended disclosure of directory data, compromising confidentiality. This weakness is classified as CWE‑90.

Affected Systems

PowerDNS Authoritative software is affected. The CVE statement does not list precise version numbers, so any installation of PowerDNS Authoritative with 8bit‑dns enabled is potentially vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is currently available. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Exploitation requires the target to be reachable and running with 8bit‑dns enabled; an attacker can send crafted DNS queries over the network to trigger the injection and read internal LDAP data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Disable the 8bit‑dns feature if it is not required for your deployment.
  • Check the PowerDNS vendor site for patch releases or newer versions that fix the escaping issue and apply the update.
  • Monitor LDAP query logs and network traffic for abnormal directory access patterns, and apply network segmentation to limit exposure of the LDAP service.

Generated by OpenCVE AI on April 22, 2026 at 18:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6233-1 pdns security update
History
Type Values Removed Values Added
CPEs cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Powerdns
Powerdns authoritative
Vendors & Products Powerdns
Powerdns authoritative
Type Values Removed Values Added
Weaknesses CWE-90
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.
Title LDAP DN injection
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses
  • CWE-90

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Sources

Status
PUBLISHED
Assigner
OX
Published
Updated
Apr 22, 2026, 2:27 PM
Reserved
Mar 23, 2026, 12:58 PM

View source JSON

Updated
Apr 22, 2026, 2:26 PM

JSON

Status
Analyzed
Published
Apr 22, 2026, 2:16 PM
Modified
Oct 26, 2026, 12:10 AM

View source JSON

No data.

Updated
Apr 22, 2026, 7:00 PM

JSON