CVE-2026-33602

CVE-2026-33602 is a denial of service vulnerability affecting UDP-based backend systems, where a malicious backend server can send a specially crafted response with a query ID offset by one from the maximum configured value, resulting in an out-of-bounds memory write. The vulnerability has a CVSS score of 6.5 (Medium) with a network attack vector, high complexity requirement, and no privilege escalation needed, resulting in limited integrity impact but significant availability impact. Exploitation requires a rogue or compromised backend server on the network, making the attack complexity high, though the vulnerability could lead to service disruption or system crashes. There is currently no evidence of active exploitation in the wild, with no known exploit code publicly available and the vulnerability absent from the CISA Known Exploited Vulnerabilities list. Community attention remains minimal, as reflected in the extremely low EPSS score of 0.00005, indicating this is a relatively low-priority concern in the broader threat landscape.