CVE-2026-33258: DNS Server DoS Vulnerability via Cache

CVE-2026-33258 Overview

By publishing and querying a crafted zone, an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches. This resource exhaustion vulnerability (CWE-770) affects DNS recursive resolvers by allowing attackers to consume excessive memory through specially crafted DNS zones, potentially leading to service degradation or denial of service conditions.

Critical Impact

Attackers can exploit crafted DNS zones to exhaust server memory resources through the NSEC(3) cache mechanism, potentially causing DNS resolver service disruption.

Affected Products

• PowerDNS Recursor (specific versions detailed in vendor advisory)

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-33258 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-33258

Vulnerability Analysis

This vulnerability represents a resource exhaustion flaw (CWE-770: Allocation of Resources Without Limits or Throttling) in the DNS resolver's cache management system. The weakness lies in how the PowerDNS Recursor handles NSEC and NSEC3 records when processing responses from malicious authoritative DNS servers.

NSEC (Next Secure) and NSEC3 records are used in DNSSEC to provide authenticated denial of existence for DNS records. The aggressive NSEC caching feature, designed to improve resolver performance by caching negative responses, can be abused when processing specially crafted zones. An attacker controlling a malicious zone can construct NSEC(3) records that trigger the allocation of disproportionately large cache entries relative to the input data.

Root Cause

The root cause stems from insufficient resource allocation controls when processing NSEC and NSEC3 records. The resolver does not adequately limit the memory consumed by individual cache entries derived from NSEC(3) data. When aggressive negative caching synthesizes denial-of-existence responses from NSEC(3) records, maliciously crafted records can cause memory allocation far exceeding expected bounds.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker must first publish a crafted DNS zone containing malicious NSEC(3) records on an authoritative server they control. The attacker then induces the target recursive resolver to query for records within this malicious zone, either by directly querying the resolver or by triggering queries through other means such as email delivery or web content that causes DNS lookups.

When the target resolver processes responses containing the crafted NSEC(3) records, it allocates excessive memory in its negative and aggressive NSEC(3) caches. Repeated exploitation can lead to memory exhaustion, degraded resolver performance, or complete service unavailability.

Detection Methods for CVE-2026-33258

Indicators of Compromise

• Unusual memory growth in the PowerDNS Recursor process
• Abnormally large NSEC/NSEC3 cache sizes reported in resolver statistics
• DNS query patterns showing repeated queries to unfamiliar or suspicious domains
• Resolver performance degradation without corresponding increase in legitimate traffic

Detection Strategies

• Monitor PowerDNS Recursor memory usage metrics and alert on abnormal growth patterns
• Implement logging and alerting for NSEC/NSEC3 cache size thresholds
• Analyze DNS query logs for patterns indicating cache poisoning or exhaustion attempts
• Deploy network-based detection for anomalous DNS response sizes from authoritative servers

Monitoring Recommendations

• Configure resource monitoring dashboards to track resolver memory consumption over time
• Set up automated alerts when cache sizes exceed baseline thresholds
• Review DNS query logs periodically for queries to newly registered or suspicious domains
• Monitor system-level metrics including swap usage and OOM killer activity

How to Mitigate CVE-2026-33258

Immediate Actions Required

• Review the PowerDNS Security Advisory 2026-03 for patch availability
• Apply vendor-provided patches as soon as they become available
• Consider disabling or limiting aggressive NSEC caching if operationally feasible
• Implement memory limits for the PowerDNS Recursor process to prevent complete system exhaustion

Patch Information

PowerDNS has published a security advisory addressing this vulnerability. Administrators should consult the PowerDNS Security Advisory 2026-03 for specific patching instructions and affected version information.

Workarounds

• Configure system-level memory limits (cgroups, ulimits) to constrain resolver resource consumption
• Consider temporarily disabling aggressive NSEC caching via recursor configuration
• Implement rate limiting for queries to limit the rate of potential exploitation attempts
• Deploy monitoring to detect and respond to abnormal memory consumption before service impact

# Example: Configure memory limits using systemd
# Add to /etc/systemd/system/pdns-recursor.service.d/limits.conf
[Service]
MemoryMax=2G
MemoryHigh=1.5G