CVE-2026-33610: PowerDNS Secondary Server DoS Vulnerability

CVE-2026-33610 Overview

A denial of service vulnerability exists in PowerDNS where a rogue primary server may cause file descriptor exhaustion on a PowerDNS secondary server. This occurs when the secondary server forwards a DNS update request to the malicious primary server, which can be exploited to exhaust system resources and disrupt DNS services.

Critical Impact

A rogue DNS primary server can trigger file descriptor exhaustion on PowerDNS secondary servers, leading to denial of service and potential disruption of DNS resolution for dependent services.

Affected Products

• PowerDNS Authoritative Server (secondary/slave configurations)
• PowerDNS deployments with DNS update forwarding enabled

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-33610 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-33610

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), affecting PowerDNS secondary servers in configurations where DNS update requests are forwarded to primary servers. The attack leverages the trust relationship between secondary and primary DNS servers in a zone transfer configuration.

When a PowerDNS secondary server receives a DNS update request (RFC 2136), it may forward this request to its configured primary server. A malicious or compromised primary server can exploit this behavior by manipulating responses in a way that causes the secondary server to leak file descriptors. Over time, this exhausts the available file descriptors on the secondary server, preventing it from accepting new connections and ultimately causing a denial of service condition.

The attack requires network access to the DNS infrastructure and the ability to control or impersonate a primary DNS server. While the attack complexity is considered high due to these prerequisites, successful exploitation can significantly impact DNS availability for organizations relying on the affected PowerDNS secondary server.

Root Cause

The root cause is improper resource management in the file descriptor handling logic when PowerDNS secondary servers process DNS update request forwarding. The server fails to properly release file descriptors under certain error conditions or malicious response patterns from the primary server, leading to gradual resource exhaustion.

Attack Vector

The attack requires a threat actor to either compromise an existing primary DNS server or position a rogue server as the primary for a PowerDNS secondary server. Once in position, the attacker can trigger the vulnerability by:

1. Waiting for legitimate DNS update requests to be forwarded to the rogue primary
2. Responding with specially crafted or malformed responses that trigger the file descriptor leak
3. Repeating this process until the secondary server's file descriptor limit is reached
4. The secondary server becomes unable to process new DNS requests, causing denial of service

The network-based attack vector means the vulnerability can potentially be exploited remotely, though it requires specific positioning within the DNS infrastructure.

Detection Methods for CVE-2026-33610

Indicators of Compromise

• Abnormal increase in open file descriptors on PowerDNS secondary servers
• DNS query failures or timeouts from secondary servers
• Error logs indicating "too many open files" or similar resource exhaustion messages
• Unusual DNS update request forwarding patterns to primary servers

Detection Strategies

• Monitor file descriptor usage on PowerDNS secondary servers with alerts for abnormal growth
• Implement logging for DNS update request forwarding operations
• Track connection patterns between secondary and primary DNS servers for anomalies
• Deploy network monitoring to detect suspicious DNS update traffic patterns

Monitoring Recommendations

• Set up threshold-based alerting for file descriptor counts on DNS servers
• Review PowerDNS logs regularly for resource exhaustion warnings
• Monitor DNS service availability with synthetic monitoring probes
• Implement connection tracking between DNS infrastructure components

How to Mitigate CVE-2026-33610

Immediate Actions Required

• Review the PowerDNS Security Advisory for specific patch information
• Audit primary server configurations to ensure only trusted servers are configured
• Consider temporarily disabling DNS update forwarding if not required for operations
• Increase system file descriptor limits as a temporary mitigation

Patch Information

PowerDNS has released a security advisory addressing this vulnerability. Administrators should consult the PowerDNS Security Advisory for detailed patch information and updated package versions. Apply the appropriate security update for your PowerDNS installation as soon as possible.

Workarounds

• Restrict network access to DNS update functionality using firewall rules
• Implement strict access control lists (ACLs) for primary server connections
• Consider running PowerDNS secondary servers in isolated environments with resource limits
• Deploy monitoring to detect and alert on file descriptor exhaustion before service impact

# Configuration example - Increase system file descriptor limits (temporary mitigation)
# Edit /etc/security/limits.conf
pdns soft nofile 65536
pdns hard nofile 65536

# Verify current limits for PowerDNS process
cat /proc/$(pidof pdns_server)/limits | grep "open files"

# Monitor file descriptor usage
ls /proc/$(pidof pdns_server)/fd | wc -l