BSD PortsPowerDNS -- vulnerabilities
· CVE-2026-33257, CVE-2026-33260, CVE-2026-33608, CVE-2026-33609, CVE-2026-33610, CVE-2026-33611, CVE-2026-42005 · VuXML entry
PowerDNS Team reports: CVE-2026-33257: Insufficient input validation of internal webserver CVE-2026-33260: Insufficient input validation of internal webserver CVE-2026-33608: Incomplete domain name sanitization during Bind autosecondary zone transfer CVE-2026-33609: LDAP DN injection CVE-2026-33610: Possible file descriptor exhaustion in forward-dnsupdate CVE-2026-33611: Insufficient validation of HTTPS and SVCB …
Affected versions
- powerdns < 5.1.2
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | dns/powerdns | 5.1.4_3 | fixed | (39 days after) |
| OpenBSD | net/powerdns | 5.1.4p0 | out of range, by version | |
| NetBSD | net/powerdns | 5.1.4nb1 | not listed | |
| MidnightBSD | dns/powerdns | 5.1.4 | out of range, by version |