CVE-2026-33600 is a denial of service vulnerability affecting DNS Response Policy Zone (RPZ) processing in unspecified products. A malicious authoritative server can trigger a null pointer dereference by sending a specially crafted RPZ, exploiting a missing consistency check in the affected software. The vulnerability carries a CVSS score of 4.4 (Medium severity) with a network-based attack vector requiring high privileges and elevated attack complexity, resulting in service availability impact only. The EPSS score of 0.00018 indicates extremely low real-world exploitation probability compared to the broader CVE population. There is no evidence of active exploitation at this time. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and maintains an inactive status on vulnerability hotlists, suggesting minimal community attention and no publicly available weaponized exploit code. Organizations should apply patches when available but may deprioritize remediation given the low exploitation likelihood.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.2.0, < 5.2.9CPE match | cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:* | ||
>= 5.3.0, < 5.3.6CPE match | cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:* | ||
>= 5.4.0, < 5.4.1CPE match | cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:* | ||
5.4.0CPE matchmatch criteria | cpe:2.3:a:powerdns:recursor:5.4.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.