PowerDNS Recursor up to 5.2.10/5.3.7/5.4.2 Zone ZoneToCache acceptance of extraneous untrusted data with trusted data

Summaryinfo

A vulnerability identified as problematic has been detected in PowerDNS Recursor up to 5.2.10/5.3.7/5.4.2. Impacted is the function ZoneToCache of the component Zone Handler. Performing a manipulation results in acceptance of extraneous untrusted data with trusted data. This vulnerability is identified as CVE-2026-33612. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in PowerDNS Recursor up to 5.2.10/5.3.7/5.4.2. This affects the function ZoneToCache of the component Zone Handler. The manipulation with an unknown input leads to a acceptance of extraneous untrusted data with trusted data vulnerability. CWE is classifying the issue as CWE-349. The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted. This is going to have an impact on integrity, and availability. The summary by CVE is:

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.

The weakness was released by Danial Mahadzir. It is possible to read the advisory at docs.powerdns.com. This vulnerability is uniquely identified as CVE-2026-33612 since 03/23/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 5.2.11, 5.3.8 or 5.4.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Domain Name Software

Vendor

• PowerDNS

Name

• Recursor

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.2.8
• 5.2.9
• 5.2.10
• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.4.0
• 5.4.1
• 5.4.2

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion