Описание
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| dnsdist | fixed | 2.0.4-1 | package | |
| dnsdist | end-of-life | bookworm | package | |
| dnsdist | end-of-life | bullseye | package | |
| pdns-recursor | fixed | 5.3.0-1 | package | |
| pdns-recursor | end-of-life | bookworm | package | |
| pdns-recursor | end-of-life | bullseye | package | |
| pdns | fixed | 5.0.4-1 | package | |
| pdns | end-of-life | bookworm | package | |
| pdns | end-of-life | bullseye | package |
Примечания
https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html#cve-2026-33260-insufficient-input-validation-of-internal-webserver
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-03.html#cve-2026-33260-insufficient-input-validation-of-internal-web-server
According to the advisory affects only PowerDNS Recursor up to and including 5.2.8,
Mark the first version in unstable after 5.2.9 as the fixed version.
https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-05.html
Связанные уязвимости
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
