[UPDATE] [medium] PowerDNS: Multiple Vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities enable denial of service attacks, data manipulation, and information disclosure in PowerDNS.

Who is affected

PowerDNS deployments of affected versions are exposed.

Urgency

Medium priority; denial of service and information disclosure are possible but exploitation is not confirmed.

Action

Apply patches for CVE-2026-33608, CVE-2026-33609, CVE-2026-33610, CVE-2026-33611, CVE-2026-33257, and CVE-2026-33260.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

medium

Published

2026-08-06

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1236

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-336080.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-336090.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-336100.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-336110.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-332570.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-332600.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• medium[UPDATE] [medium] PowerDNS: Multiple vulnerabilitiescert-bund
• medium[UPDATE] [medium] DNSdist: Multiple vulnerabilities allow denial of servicecert-bund

More from CERT-Bund (BSI) Security Advisories

• medium[NEW] [medium] jsoup: Vulnerability enables Cross-Site Scripting2026-08-07
• high[NEW] [high] Apache Portable Runtime (APR): Multiple vulnerabilities2026-08-07
• high[UPDATE] [high] Linux Kernel: Multiple Vulnerabilities2026-08-07
• medium[UPDATE] [medium] Golang Go: Multiple vulnerabilities2026-08-07
• high[UPDATE] [high] Linux Kernel: Multiple vulnerabilities2026-08-07