Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-33611

Summary
Assigner-OX
Assigner Org ID-8ce71d90-2354-404b-a86e-bec2cc4e6981
Published At-22 Apr, 2026 | 14:01
Updated At-22 Apr, 2026 | 14:24
Rejected At-
Credits

Insufficient validation of HTTPS and SVCB records

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:OX
Assigner Org ID:8ce71d90-2354-404b-a86e-bec2cc4e6981
Published At:22 Apr, 2026 | 14:01
Updated At:22 Apr, 2026 | 14:24
Rejected At:
â–¼CVE Numbering Authority (CNA)
Insufficient validation of HTTPS and SVCB records

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

Affected Products
Vendor
PowerDNS
Product
Authoritative
Collection URL
https://repo.powerdns.com/
Package Name
pdns
Repo
https://github.com/PowerDNS/pdns
Modules
  • SVCB/ALPN parsing
Program Files
  • dnswriter.cc
  • rcpgenerator.cc
Default Status
unaffected
Versions
Affected
  • From 5.0.0 before 5.0.4 (semver)
  • From 4.9.0 before 4.9.14 (semver)
Problem Types
TypeCWE IDDescription
CWEIntegerInteger Overflow or Wraparound
Type: CWE
CWE ID: Integer
Description: Integer Overflow or Wraparound
Metrics
VersionBase scoreBase severityVector
3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

finder
Tibs
Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html
N/A
Hyperlink: https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html
Resource: N/A
â–¼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-190CWE-190 Integer Overflow or Wraparound
Type: CWE
CWE ID: CWE-190
Description: CWE-190 Integer Overflow or Wraparound
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@open-xchange.com
Published At:22 Apr, 2026 | 14:16
Updated At:12 May, 2026 | 20:16

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Primary3.14.9MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Type: Secondary
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Type: Primary
Version: 3.1
Base score: 4.9
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CPE Matches

powerdns
powerdns
>>authoritative>>Versions from 4.9.0(inclusive) to 4.9.14(exclusive)
cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*
powerdns
powerdns
>>authoritative>>Versions from 5.0.0(inclusive) to 5.0.4(exclusive)
cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-190Secondary134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE ID: CWE-190
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.htmlsecurity@open-xchange.com
Broken Link
Hyperlink: https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html
Source: security@open-xchange.com
Resource:
Broken Link

Change History

0
Information is not available yet

Similar CVEs

8Records found

CVE-2026-33600
Matching Score-8
Assigner-Open-Xchange
ShareView Details
Matching Score-8
Assigner-Open-Xchange
CVSS Score-4.4||MEDIUM
EPSS-0.02% / 6.61%
||
7 Day CHG~0.00%
Published-22 Apr, 2026 | 09:33
Updated-27 Apr, 2026 | 16:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Null pointer dereference in RPZ transfer

An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

Action-Not Available
Vendor-powerdnsPowerDNS
Product-recursorRecursor
CWE ID-CWE-476
NULL Pointer Dereference
CVE-2026-33601
Matching Score-8
Assigner-Open-Xchange
ShareView Details
Matching Score-8
Assigner-Open-Xchange
CVSS Score-4.4||MEDIUM
EPSS-0.01% / 0.25%
||
7 Day CHG~0.00%
Published-22 Apr, 2026 | 09:37
Updated-27 Apr, 2026 | 16:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Insufficient validation of zonemd record

If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

Action-Not Available
Vendor-powerdnsPowerDNS
Product-recursorRecursor
CWE ID-CWE-476
NULL Pointer Dereference
CVE-2026-33596
Matching Score-6
Assigner-Open-Xchange
ShareView Details
Matching Score-6
Assigner-Open-Xchange
CVSS Score-3.1||LOW
EPSS-0.01% / 0.40%
||
7 Day CHG~0.00%
Published-22 Apr, 2026 | 13:47
Updated-24 Apr, 2026 | 18:50
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
TCP backend stream ID overflow

A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend.

Action-Not Available
Vendor-powerdnsPowerDNS
Product-dnsdistDNSdist
CWE ID-CWE-190
Integer Overflow or Wraparound
CVE-2016-2120
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-7.5||HIGH
EPSS-0.13% / 32.06%
||
7 Day CHG~0.00%
Published-01 Nov, 2018 | 13:00
Updated-05 Aug, 2024 | 23:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record. The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary.

Action-Not Available
Vendor-powerdns[UNKNOWN]Debian GNU/Linux
Product-debian_linuxauthoritativepdns
CWE ID-CWE-190
Integer Overflow or Wraparound
CVE-2024-53880
Matching Score-4
Assigner-NVIDIA Corporation
ShareView Details
Matching Score-4
Assigner-NVIDIA Corporation
CVSS Score-4.9||MEDIUM
EPSS-0.07% / 21.79%
||
7 Day CHG~0.00%
Published-12 Feb, 2025 | 00:39
Updated-22 Sep, 2025 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

NVIDIA Triton Inference Server contains a vulnerability in the model loading API, where a user could cause an integer overflow or wraparound error by loading a model with an extra-large file size that overflows an internal variable. A successful exploit of this vulnerability might lead to denial of service.

Action-Not Available
Vendor-Linux Kernel Organization, IncMicrosoft CorporationNVIDIA Corporation
Product-linux_kerneltriton_inference_serverwindowsTriton Inference Server
CWE ID-CWE-190
Integer Overflow or Wraparound
CVE-2022-1926
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
ShareView Details
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
CVSS Score-7.6||HIGH
EPSS-0.41% / 61.58%
||
7 Day CHG~0.00%
Published-31 May, 2022 | 08:30
Updated-03 Aug, 2024 | 00:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Integer Overflow or Wraparound in polonel/trudesk

Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.

Action-Not Available
Vendor-trudesk_projectpolonel
Product-trudeskpolonel/trudesk
CWE ID-CWE-190
Integer Overflow or Wraparound
CVE-2026-39811
Matching Score-4
Assigner-Fortinet, Inc.
ShareView Details
Matching Score-4
Assigner-Fortinet, Inc.
CVSS Score-4.4||MEDIUM
EPSS-0.13% / 31.61%
||
7 Day CHG~0.00%
Published-14 Apr, 2026 | 15:38
Updated-21 Apr, 2026 | 17:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to denial of service via <insert attack vector here>

Action-Not Available
Vendor-Fortinet, Inc.
Product-fortiwebFortiWeb
CWE ID-CWE-190
Integer Overflow or Wraparound
CVE-2019-12693
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.36% / 58.13%
||
7 Day CHG~0.00%
Published-02 Oct, 2019 | 19:06
Updated-21 Nov, 2024 | 19:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco Adaptive Security Appliance Software Secure Copy Denial of Service Vulnerability

A vulnerability in the Secure Copy (SCP) feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to the use of an incorrect data type for a length variable. An attacker could exploit this vulnerability by initiating the transfer of a large file to an affected device via SCP. To exploit this vulnerability, the attacker would need to have valid privilege level 15 credentials on the affected device. A successful exploit could allow the attacker to cause the length variable to roll over, which could cause the affected device to crash.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-asa_5550adaptive_security_applianceasa_5505adaptive_security_appliance_softwareasa_5555-xasa_5520asa_5510asa_5525-xasa_5580asa_5585-xasa_5512-xasa_5515-xCisco Adaptive Security Appliance (ASA) Software
CWE ID-CWE-704
Incorrect Type Conversion or Cast
CWE ID-CWE-190
Integer Overflow or Wraparound
Details not found