« Volver al listado

CVE-2026-33595

Estado: AnalizadaAlta (7.5)—

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:N/AC:L/PR:N indica red sin autenticación (T1190). CWE-770 (asignación excesiva de memoria) y descripción de agotamiento de recursos en conexión DoQ/DoH3 = DoS (T1499.004: Application Exhaustion).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Powerdns — Dnsdist

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33595",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33595",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-22T14:40:24.979374Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@open-xchange.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@open-xchange.com",
      "affectedData": [
        {
          "repo": "https://github.com/PowerDNS/pdns",
          "vendor": "PowerDNS",
          "modules": [
            "DNS over QUIC",
            "DNS over HTTP3"
          ],
          "product": "DNSdist",
          "versions": [
            {
              "status": "affected",
              "version": "1.9.0",
              "lessThan": "1.9.13",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.0.4",
              "versionType": "semver"
            }
          ],
          "packageName": "dnsdist",
          "programFiles": [
            "doq.cc",
            "doh3.cc"
          ],
          "collectionURL": "https://repo.powerdns.com/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-22T14:16:53.950",
  "references": [
    {
      "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@open-xchange.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection."
    }
  ],
  "lastModified": "2026-06-17T10:37:45.663",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCC2DF11-EC5C-4112-90F2-C266CB65D390",
              "versionEndExcluding": "1.9.13",
              "versionStartIncluding": "1.9.0"
            },
            {
              "criteria": "cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29865EC6-C1A0-40F3-B0BB-7F71F9C1DCB7",
              "versionEndExcluding": "2.0.4",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@open-xchange.com"
}