# CVE-2026-33610: A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS…

Source: https://junglewise.ai/threats/cve-2026-33610-a-rogue-primary-server-may-cause-file-descriptor-exhaustion-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22  
License: CC BY 4.0 with a link back

CVE-2026-33610 · Severity: medium · CVSS 5.9 · Published 2026-04-22

A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.

Technologies: [Powerdns Authoritative](https://junglewise.ai/threats/technologies/authoritative). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-33610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33610 being exploited in the wild.

**How severe is CVE-2026-33610?** Medium severity, with a CVSS score of 5.9, published 22 April 2026.

**Which products and versions are affected?** Powerdns Authoritative. The advisory does not name versions.

**Is there a fix for CVE-2026-33610?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-33610?** Check whether you run Powerdns Authoritative. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Powerdns Authoritative

## Related threats

- [Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.](https://junglewise.ai/threats/cve-2026-33609-incomplete-escaping-of-ldap-queries-when-running-with-8bit-dns)
- [An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes…](https://junglewise.ai/threats/cve-2026-33608-an-attacker-can-send-a-notify-request-that-causes-a-new-secondary)
- [An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33260-an-attacker-can-send-a-web-request-that-causes-unlimited-memory)
- [An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33257-an-attacker-can-send-a-web-request-that-causes-unlimited-memory)