Concurrent modification of RPZ data can lead to denial of se… (CVE-2026-33259)

Summary

Concurrent modification of RPZ data can lead to denial of servce

Original description

The description as published by the source.

Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2026-33259 pdns-recursor
Ubuntu UBUNTU-CVE-2026-33259 pdns-recursor

References

advisory docs.powerdns.com
advisory github.com
advisory nvd.nist.gov
package github.com
web repo.powerdns.com