DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
PowerDNS: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-04-21
Ein Angreifer kann mehrere Schwachstellen in PowerDNS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um einen Denial of Service Angriff durchzuführen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-33601US | medium4.9 | — | ||
If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency ch… | ||||
| CVE-2026-33600US | medium4.9 | — | ||
An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. | ||||
| CVE-2026-33262US | medium5.9 | — | ||
An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default. | ||||
| CVE-2026-33261US | — | — | ||
A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service. | ||||
| CVE-2026-33260US | high7.5 | — | ||
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by defaul… | ||||
| CVE-2026-33259US | — | — | ||
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zon… | ||||
| CVE-2026-33258US | high7.5 | — | ||
By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches. | ||||
| CVE-2026-33257US | high7.5 | — | ||
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by defaul… | ||||
| CVE-2026-33256US | high7.5 | — | ||
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by defaul… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- PowerDNS Security Advisory vom 2026-04-21external
- cPanel & WHM Change Logexternal
- Debian Security Advisory DSA-6234 vom 2026-04-29external
- openSUSE Security Update OPENSUSE-SU-2026:10632-1 vom 2026-04-29external
- SUSE Security Update SUSE-SU-2026:22319-1 vom 2026-07-01external
- WID-SEC-W-2026-1225 - CSAF Versionself
- WID-SEC-2026-1225 - Portal Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan