Alpine: multiple pdns-recursor packages: security update to 5.3.6-r0

high Tenable Cloud Security Plugin ID 440948

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- By publishing and querying a crafted zone an attacker can cause allocation of large entries in the
negative and aggressive NSEC(3) caches. (CVE-2026-33258)

- An attacker can send a web request that causes unlimited memory allocation in the internal web server,
leading to a denial of service. The internal web server is disabled by default. (CVE-2026-33256)

- Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or
a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a
malfunctioning RPZ provider. (CVE-2026-33259)

- A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of
service. (CVE-2026-33261)

Solution

Update the pdns-recursor library and its related packages to version 5.3.6-r0 or later.

Plugin Details

Severity: High

ID: 440948

Version: Revision 1.5

Type: Local

Family: Alpine Linux Local Security Checks

Published: 4/28/2026

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 52.04

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-33258

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/22/2026

Reference Information

CVE: CVE-2026-33256, CVE-2026-33258, CVE-2026-33259, CVE-2026-33261, CVE-2026-33600, CVE-2026-33601

Detections

Analytics