PatchTheCVErecursor vulnerabilities and fixes
Recent CVEs affecting recursor, with upgrade or downgrade steps. 4 tracked.
recursor has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-04-22. Highest priority: CVE-2026-33256 (score 36/100).
- CVE-2026-33256 MEDIUM 5.3 UPGRADE An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading
- CVE-2026-33262 MEDIUM 5.9 UPGRADE An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check
- CVE-2026-33601 MEDIUM 4.4 UPGRADE If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that re
- CVE-2026-33259 MEDIUM 5.0 UPGRADE Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a cr
FAQ
How do I fix recursor vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is recursor being exploited right now?
None of the tracked recursor CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which recursor CVE should I patch first?
CVE-2026-33256 currently ranks highest (36/100): An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading.