CVE-2026-33612: DNS Cache Poisoning via Malicious Zone Data

Technical summary

The vulnerability exists in the ZoneToCache function's handling of zone data received from authoritative DNS servers. The function fails to properly validate or sanitize crafted zone contents before caching them, allowing an attacker controlling an authoritative nameserver to inject malicious DNS records into a resolver's cache. The flaw is classified under CWE-349 (Improper Restriction of Rendered UI Layers or Frames), though the root cause appears to be insufficient input validation during zone deserialization or cache storage. Exploitation requires network access to the vulnerable resolver and does not require authentication or special privileges.

Business impact

Cache poisoning attacks undermine the integrity of DNS resolution across an organization. Once a resolver's cache is poisoned, all internal and external users relying on that resolver may be directed to attacker-controlled infrastructure. This can lead to credential theft, malware distribution, financial fraud, and service disruption. Organizations with many users querying shared resolvers face organization-wide impact; impacts scale with resolver usage. Attackers need not compromise internal systems—only trick the resolver into trusting a malicious authoritative server, lowering the barrier to attack.

Affected systems

The source data provided does not list specific vendor or product names. This indicates either a generic DNS resolver component or that affected vendor information is not yet published. Organizations using standard-issue DNS resolvers, recursive resolvers, or DNS caching layers should treat this as potentially relevant. Verify the vendor advisory and your resolver vendor's security bulletins to confirm whether your deployment is affected. The scope of impact (CVSS S:C) suggests the vulnerability can affect systems beyond the immediate resolver.

Exploitability

Exploitability is moderate. The attack vector is network-based and requires no authentication or user interaction, making it accessible to remote attackers. However, the attacker must either control an authoritative nameserver that a victim resolver queries, or intercept and modify zone transfer traffic. Attack complexity is rated as high, suggesting that specific conditions must align—such as the resolver querying the malicious server or the attacker's ability to influence which servers are queried. Real-world exploitation is feasible for determined attackers with DNS infrastructure access or network positioning.

Remediation

Apply security updates from your DNS resolver vendor as soon as they become available. Verify vendor advisories to confirm patch availability and affected versions. Until patching is possible, consider implementing network controls: restrict zone transfers to trusted authoritative servers, enable DNSSEC validation to detect poisoned records, monitor cache behavior for anomalies, and use DNS query logging to detect redirection attempts. Isolate or segment DNS resolvers by function if possible to limit blast radius.

Patch guidance

Consult your DNS resolver vendor's security advisory for patch availability and version numbers. Apply patches in a staged manner: test in non-production environments first, then deploy to less critical resolvers before rolling out to production. Given the HIGH severity and broad scope, prioritize patching within 2–4 weeks. Verify that patches are installed by checking resolver version information and validating that zone caching behavior has been corrected.

Detection guidance

Monitor DNS resolvers for signs of cache poisoning: sudden DNS resolution failures for legitimate domains, resolution of internal hostnames to unexpected IP addresses, and queries to known malicious infrastructure from legitimate domains. Implement DNS query logging and compare query results against baseline records. DNSSEC validation can detect some poisoning attempts if enabled. Examine resolver logs for zone transfer anomalies or unusual zone data sizes. Correlate alerts with reports of unexpected redirections or failed services to identify affected users.

Why prioritize this

This vulnerability scores 7.5 (HIGH) due to its network-accessible attack vector, high integrity impact (I:H), and service availability impact (A:L) affecting a foundational network service. Cache poisoning is a particularly damaging class of attack because it affects all users of the poisoned resolver with no additional attacker effort. While it is not yet in the KEV catalog and exploit code is not public, the attack model is well understood in security research. Organizations should treat this as a near-term priority given DNS's critical role in network operations.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: (1) Network-based attack vector requiring no authentication (AV:N, PR:N, UI:N) favoring broad exploitability; (2) High complexity (AC:H) reflecting the need for specific conditions like resolving through a malicious authoritative server; (3) Changed scope (S:C) indicating impact beyond the resolver itself to downstream services; (4) High integrity impact (I:H) as DNS data is corrupted; (5) Low availability impact (A:L) from potential service degradation. The score appropriately penalizes the widespread potential for harm balanced against exploitation constraints.

Frequently asked questions