The vulnerability CVE-2026-33599 affects PowerDNS DNSdist versions 1.9.0 and 2.0.0. It arises when a rogue backend sends a specially crafted SVCB response to a Discovery of Designated Resolvers (DDR) request. This triggers an out-of-bounds read condition if the DDR upgrade feature is enabled through the autoUpgrade (Lua) or auto_upgrade (YAML) configuration options. Since DDR upgrade is not enabled by default, the attack surface is limited. The CVSS score is 3.1, indicating low severity, with an attack vector requiring adjacent network access, high attack complexity, no privileges required, no user interaction, and only a low impact on availability. No patches or vendor advisories specifying remediation are currently available.

The vulnerability can cause a low-impact availability issue due to an out-of-bounds read when processing crafted SVCB responses. There is no impact on confidentiality or integrity. Exploitation requires a rogue backend and enabling of the DDR upgrade feature, which is disabled by default. No known exploits have been reported in the wild.

Since the DDR upgrade feature is not enabled by default, avoiding enabling autoUpgrade (Lua) or auto_upgrade (YAML) settings prevents exposure. No official patch or remediation guidance is currently available. Users should monitor vendor advisories for updates and consider disabling the DDR upgrade feature if it is enabled and not required.