CVE-2026-33598 is an out of bounds read in PowerDNS DNSdist that needs custom Lua code to call a packet cache inspection function. NVD scores it 4.8 and PowerDNS rates it Low. Upgrade to DNSdist 1.9.13 or 2.0.4, or stop calling the two affected functions.
What's affected
PowerDNS Security Advisory 2026-04 for DNSdist says DNSdist up to and including 2.0.3 and 1.9.12 is affected. DNSdist 1.9.13 and 2.0.4 are not affected.
The trigger is narrow. A cached crafted response can cause the read only if your Lua configuration calls getDomainListByAddress() or getAddressListByDomain() on a packet cache. Installs that never call those functions are not exposed to this particular issue. The advisory lists the impact as denial of service and the risk of system compromise as none.
How to check if you're exposed
Check the running version:
dnsdist --version
Then search your configuration and any included Lua files for the two function names:
grep -rn "getDomainListByAddress\|getAddressListByDomain" /etc/dnsdist/
A version at or below 1.9.12 or 2.0.3 together with a match means you are in the affected group. The same advisory covers other DNSdist issues, so use it to decide your upgrade target.
What to do now
- Upgrade DNSdist to 1.9.13 or 2.0.4 or later, matching the branch you run.
- If you cannot upgrade yet, stop calling
getDomainListByAddressandgetAddressListByDomain, which is the second remedy the advisory gives. - Review the other CVEs listed in the same PowerDNS advisory, since the same upgrade covers them.
- Add DNSdist to your dependency and package inventory so future advisories reach the right owner.
Why it matters
The record maps this to CWE-125, out of bounds read. Code reads memory past the end of a buffer, which can crash the process or return data it should not. In a DNS load balancer, a crash affects every client behind it.
The low rating reflects the preconditions. The attacker needs a response to land in the packet cache and your own Lua must inspect it with those two calls. It is a good example of why configuration matters as much as version number when you triage. The record is not marked as exploited in the wild and is not in CISA KEV.
Quick check
Am I affected if I never use those Lua functions?
Not by this issue, according to the advisory trigger. Upgrade anyway, because the same release fixes other DNSdist problems.
Sources
Last reviewed: 19 October 2026.
