CVE-2026-33598

CVE-2026-33598 is a medium-severity vulnerability affecting packet cache implementations where a specially crafted cached response can trigger an out-of-bounds read when custom Lua code invokes the getDomainListByAddress() or getAddressListByDomain() functions. The vulnerability has a CVSS score of 4.8 with a network-based attack vector that requires no user interaction but has elevated complexity, resulting in limited confidentiality and availability impacts. Exploitation requires relatively sophisticated attack conditions, and the vulnerability currently shows minimal community attention with no evidence of active exploitation in the wild, no public exploit code availability, and no inclusion in the CISA Known Exploited Vulnerabilities catalog. The FAUCET Risk Score of 31.0 and extremely low EPSS score further indicate this poses a low immediate threat to most environments.