CVE-2026-33602
Medium · 6.5CVSS
6.5
EPSS
1.2%
Published
Apr 22, 2026
CISA due date
—
The record
A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | dnsdist | 0 | 1.9.13-160000.1.1 |
| openSUSE:Tumbleweed | dnsdist | 0 | 2.0.5-1.1 |
Related vulnerabilities
- CVE-2026-33598 A cached crafted response can cause an out-of-bounds read if custom Lua code calls… Also affects dnsdist
- CVE-2026-33596 A client might theoretically be able to cause a mismatch between queries sent to a… Also affects dnsdist
- CVE-2026-33599 A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers… Also affects dnsdist
- CVE-2026-33597 PRSD detection denial of service Also affects dnsdist
- CVE-2026-33254 An attacker can create a large number of concurrent DoQ or DoH3 connections, causing… Also affects dnsdist
- CVE-2026-33594 A client can trigger excessive memory allocation by generating a lot of queries that are… Also affects dnsdist
- CVE-2026-33595 A client can trigger excessive memory allocation by generating a lot of errors responses… Also affects dnsdist
- CVE-2026-33593 A client can trigger a divide by zero error leading to crash by sending a crafted… Also affects dnsdist