CVE-2026-33599

CVE-2026-33599 is a denial of service vulnerability affecting PowerDNS deployments that have enabled Discovery of Designated Resolvers (DDR) upgrade functionality through the autoUpgrade Lua option or auto_upgrade YAML settings. A remote attacker on the same network segment can craft a malicious SVCB response to exploit this flaw and cause service availability degradation. Since DDR upgrade is disabled by default, only systems with explicit configuration changes are at risk. The vulnerability carries a CVSS score of 3.1 (LOW) with an adjacent network attack vector, high attack complexity, and no special privileges or user interaction required. The impact is limited to availability, with no confidentiality or integrity compromise possible. The EPSS score of 0.00005 indicates minimal real-world exploitation probability compared to other published vulnerabilities. There is no evidence of active exploitation, no publicly available exploit code, and minimal community attention to this issue. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and maintains an inactive status on threat intelligence tracking lists. Organizations should prioritize patching only if DDR upgrade functionality has been explicitly enabled in their PowerDNS configurations.