CVE-2026-33611

Insufficient validation of HTTPS and SVCB records

Medium · published April 22, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00809 · 56.4th percentile
Published
2026-04-22T14:01Z
EPSS history
Timeline
  • 22 APR 14:01Z
    Insufficient validation of HTTPS and SVCB records
    cvelistv5