CVE-2026-33611

{
  "id": "CVE-2026-33611",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-22T14:16:55.000",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend."
    },
    {
      "lang": "es",
      "value": "Un operador autorizado a usar la API REST puede causar que el servidor autoritativo produzca datos de registro HTTPS o SVCB no válidos, lo que a su vez puede causar corrupción de la base de datos LMDB, si se utiliza el backend LMDB."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "PowerDNS",
          "product": "Authoritative",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.powerdns.com/",
          "packageName": "pdns",
          "modules": [
            "SVCB/ALPN parsing"
          ],
          "programFiles": [
            "dnswriter.cc",
            "rcpgenerator.cc"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "versions": [
            {
              "version": "5.0.0",
              "lessThan": "5.0.4",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.9.0",
              "lessThan": "4.9.14",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T14:24:04.530345Z",
          "id": "CVE-2026-33611",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.9.0",
              "versionEndExcluding": "4.9.14",
              "matchCriteriaId": "08464BC2-733F-4260-878D-DE05919A7A7D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.0.0",
              "versionEndExcluding": "5.0.4",
              "matchCriteriaId": "A26C526E-15DC-41BE-9B66-FC6A63679562"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    }
  ]
}