CVE-2026-33608 affects PowerDNS Authoritative Server when it runs the Bind backend in autosecondary mode. A crafted NOTIFY can write an invalid configuration that stops the backend from starting after a restart. NVD scores it 7.4. Upgrade to 4.9.14 or 5.0.4.
What's affected
PowerDNS Security Advisory 2026-05 says PowerDNS Authoritative Server up to and including 5.0.3 and 4.9.13 is affected. Versions 4.9.14 and 5.0.4 are not affected. PowerDNS rates it High with an impact of denial of service.
Two conditions apply. The Bind backend must be in use, and the server must operate in autosecondary mode. Servers that use other backends, or that do not accept autoprimary notifications, are outside this issue.
How to check if you're exposed
Check the version and the configuration:
pdns_server --version
grep -rn "autosecondary\|bind-autoprimaries\|launch" /etc/powerdns/
If launch includes bind, autosecondary is enabled, and the version is at or below 5.0.3 or 4.9.13, you are in the affected group. The advisory describes the result as a backend that cannot run on its next restart and needs manual repair, so look at your Bind backend configuration file for entries you did not add.
What to do now
- Upgrade to PowerDNS Authoritative 4.9.14 or 5.0.4 or later.
- If you cannot upgrade, the advisory lists two remedies. Disable autosecondary operation, or limit
bind-autoprimariesto trusted addresses only. - Review the Bind backend configuration for domains that should not be there and fix any invalid entries before restarting.
- Read the other issues in the same advisory and plan one upgrade to cover them.
Why it matters
The record uses CWE-94, improper control of code generation. Here that means untrusted input, a domain name from a NOTIFY, ends up inside a configuration the server later reads as trusted. Incomplete sanitization of a name is enough to break the file.
The effect is availability, not data theft. PowerDNS says the risk of system compromise is none. A DNS server that fails to start after a routine restart is still a serious outage, because the damage waits for the next restart. The record is not marked as exploited in the wild and is not in CISA KEV.
Quick check
Does this affect servers that use a different backend?
The advisory limits the trigger to the Bind backend in autosecondary mode.
Sources
Last reviewed: 19 October 2026.
