CVE-2026-33599 — Out-of-bounds read in service discovery
A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgr…
Published: 2026-04-22 · CVSS: 3.1 · CVSS 3.1
A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7