CVE-2026-33259

MediumCVSS 5.0

Published: 22/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

Many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free, and/or a crash of the recursor. Normally such concurrent transfers occur only with a malfunctioning RPZ provider.

Risk Assessment

The recursive DNS resolver service may crash, causing name resolution outages and disruption to dependent services.

Recommendation

Update the recursor software to a version containing the fix and monitor RPZ providers for abnormal zone transfers.

Other vulnerabilities in DNS recursor

CVE-2026-52690Medium
The vulnerability allows spoofing replies to a Recursor, which may mark an IP address of an authoritative server as not supporting EDNS. As a result, validation of DNSSEC records served by that server may fail.

Original NVD description (English source)

Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS