An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - By publishing and querying a crafted zone an attacker can cause allocation of large entries in the
    negative and aggressive NSEC(3) caches. (CVE-2026-33258)

  - An attacker can send a web request that causes unlimited memory allocation in the internal web server,
    leading to a denial of service. The internal web server is disabled by default. (CVE-2026-33256)

  - Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or
    a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a
    malfunctioning RPZ provider. (CVE-2026-33259)

  - A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of
    service. (CVE-2026-33261)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An attacker can send a web request that causes unlimited memory allocation in the internal web server,     leading to a denial of service. The internal web server is disabled by default. (CVE-2026-33256)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
440948	Alpine: multiple pdns-recursor packages: security update to 5.3.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
440948	Alpine: multiple pdns-recursor packages: security update to 5.3.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
309873	Linux Distros Unpatched Vulnerability : CVE-2026-33256	Nessus	Misc.	high

Detections

Analytics

CVE-2026-33256

high

Tenable Plugins

high

high

high