CVE-2026-33593

CVE-2026-33593 is a denial of service vulnerability affecting DNSCrypt implementations that allows remote attackers to crash the service by sending a specially crafted query that triggers a divide by zero error. The vulnerability requires no authentication or user interaction, making it accessible to any network-based attacker. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector and low complexity, indicating it can be exploited remotely without special conditions. The impact is limited to availability disruption, with no confidentiality or integrity consequences. The FAUCET risk score of 48.0/100 suggests moderate concern from an operational perspective. This vulnerability currently demonstrates minimal exploitation activity and community attention. It is not present on the CISA Known Exploited Vulnerabilities (KEV) catalog, has no active status on threat intelligence hotlists, and shows an EPSS score of 0.0002, indicating very low probability of real-world exploitation at this time. However, organizations running DNSCrypt services should nonetheless apply patches when available to prevent potential abuse.