{"id":"CVE-2026-33611","state":"PUBLISHED","title":"Insufficient validation of HTTPS and SVCB records","description":"An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.","publishedAt":"2026-04-22T14:01:10.135Z","updatedAt":"2026-04-22T14:24:57.121Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","source":"OX"},"assigner":"OX","products":["PowerDNS Authoritative"],"affected":[{"vendor":"PowerDNS","product":"Authoritative","packageName":"pdns","defaultStatus":"unaffected","versions":[{"version":"5.0.0","status":"affected","lessThan":"5.0.4","versionType":"semver"},{"version":"4.9.0","status":"affected","lessThan":"4.9.14","versionType":"semver"}],"collectionURL":"https://repo.powerdns.com/","repo":"https://github.com/PowerDNS/pdns","modules":["SVCB/ALPN parsing"],"programFiles":["dnswriter.cc","rcpgenerator.cc"]}],"references":["https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"],"weaknesses":["CWE-190"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/33xxx/CVE-2026-33611.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-33611","state":"PUBLISHED","datePublished":"2026-04-22T14:01:10.135Z","dateUpdated":"2026-04-22T14:24:57.121Z","assignerShortName":"OX","assignerOrgId":"8ce71d90-2354-404b-a86e-bec2cc4e6981","dateReserved":"2026-03-23T12:58:38.267Z"},"containers":{"cna":{"title":"Insufficient validation of HTTPS and SVCB records","descriptions":[{"lang":"en","value":"An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend."}],"affected":[{"vendor":"PowerDNS","product":"Authoritative","packageName":"pdns","defaultStatus":"unaffected","versions":[{"version":"5.0.0","status":"affected","lessThan":"5.0.4","versionType":"semver"},{"version":"4.9.0","status":"affected","lessThan":"4.9.14","versionType":"semver"}],"collectionURL":"https://repo.powerdns.com/","repo":"https://github.com/PowerDNS/pdns","modules":["SVCB/ALPN parsing"],"programFiles":["dnswriter.cc","rcpgenerator.cc"]}],"references":[{"url":"https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"MEDIUM","baseScore":6.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Integer Overflow or Wraparound","type":"CWE"}]}],"providerMetadata":{"shortName":"OX","orgId":"8ce71d90-2354-404b-a86e-bec2cc4e6981","dateUpdated":"2026-04-22T14:01:10.135Z"},"datePublic":"2026-04-08T22:00:00.000Z","credits":[{"lang":"en","value":"Tibs","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-22T14:24:04.530345Z","id":"CVE-2026-33611","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","type":"CWE","lang":"en","description":"CWE-190 Integer Overflow or Wraparound"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-22T14:24:57.121Z"}}]}}}