Analysis Report · powerdns-recursor rec-5.2.8 → rec-5.2.9 — CVE-2026-33257

--- cache/pdns_rec-5.2.8/ext/yahttp/yahttp/reqresp.cpp	2026-04-29 05:56:10.170984596 +0000+++ cache/pdns_rec-5.2.9/ext/yahttp/yahttp/reqresp.cpp	2026-04-29 05:56:11.939110627 +0000@@ -40,7 +40,19 @@   }    template <class T>-  bool AsyncLoader<T>::feed(const std::string& somedata) {+  bool AsyncLoader<T>::feed(const std::string& somedata)+  {+    if (state < 2) {+      headersize += somedata.length(); // maye include some body data, we don't know yet...+      if (headersize > target->max_header_size) {+        if (target->kind == YAHTTP_TYPE_REQUEST) {+          throw ParseError("Request header too large");+        }+        else {+          throw ParseError("Response header too large");+        }+      }+    }     buffer.append(somedata);     while(state < 2) {       int cr=0;@@ -155,8 +167,8 @@         maxbody = minbody;       }       if (minbody < 1) return true; // guess there isn't anything left.-      if (target->kind == YAHTTP_TYPE_REQUEST && static_cast<ssize_t>(minbody) > target->max_request_size) throw ParseError("Max request body size exceeded");-      else if (target->kind == YAHTTP_TYPE_RESPONSE && static_cast<ssize_t>(minbody) > target->max_response_size) throw ParseError("Max response body size exceeded");+      if (target->kind == YAHTTP_TYPE_REQUEST && minbody > target->max_request_size) throw ParseError("Max request body size exceeded");+      else if (target->kind == YAHTTP_TYPE_RESPONSE && minbody > target->max_response_size) throw ParseError("Max response body size exceeded");     }      if (maxbody == 0) hasBody = false;@@ -175,20 +187,23 @@           buffer.copy(buf, pos);           buf[pos]=0; // just in case...           buffer.erase(buffer.begin(), buffer.begin()+pos+1); // remove line from buffer-          if (sscanf(buf, "%x", &chunk_size) != 1) {+          if (sscanf(buf, "%zx", &chunk_size) != 1) {             throw ParseError("Unable to parse chunk size");           }           if (chunk_size == 0) { state = 3; break; } // last chunk-          if (chunk_size > (std::numeric_limits<decltype(chunk_size)>::max() - 2)) {+          if (chunk_size > (std::numeric_limits<decltype(chunk_size)>::max() - 2) || chunk_size > maxbody) {             throw ParseError("Chunk is too large");           }         } else {           int crlf=1;-          if (buffer.size() < static_cast<size_t>(chunk_size+1)) return false; // expect newline+          if (buffer.size() < chunk_size+1) return false; // expect newline           if (buffer.at(chunk_size) == '\r') {-            if (buffer.size() < static_cast<size_t>(chunk_size+2) || buffer.at(chunk_size+1) != '\n') return false; // expect newline after carriage return+            if (buffer.size() < chunk_size+2 || buffer.at(chunk_size+1) != '\n') return false; // expect newline after carriage return             crlf=2;           } else if (buffer.at(chunk_size) != '\n') return false;+          if (bodybuf.str().length() + chunk_size > maxbody) {+            throw ParseError("Chunked body is too large");+          }           std::string tmp = buffer.substr(0, chunk_size);           buffer.erase(buffer.begin(), buffer.begin()+chunk_size+crlf);           bodybuf << tmp;

Vulnerability Existed: yes
TRUE POSITIVE
Header size limit enforcement missing ext/yahttp/yahttp/reqresp.cpp Lines 40-52
Old Code
  bool AsyncLoader<T>::feed(const std::string& somedata) {
    buffer.append(somedata);
    while(state < 2) {
      ...
Fixed Code
  bool AsyncLoader<T>::feed(const std::string& somedata)
  {
    if (state < 2) {
      headersize += somedata.length();
      if (headersize > target->max_header_size) {
        if (target->kind == YAHTTP_TYPE_REQUEST) {
          throw ParseError("Request header too large");
        }
        else {
          throw ParseError("Response header too large");
        }
      }
    }
    buffer.append(somedata);
    while(state < 2) {
      ...

Vulnerability Existed: yes
TRUE POSITIVE
Signedness/overflow in body size comparison ext/yahttp/yahttp/reqresp.cpp Lines 155-160
Old Code
      if (minbody < 1) return true;
      if (target->kind == YAHTTP_TYPE_REQUEST && static_cast<ssize_t>(minbody) > target->max_request_size) throw ParseError("Max request body size exceeded");
      else if (target->kind == YAHTTP_TYPE_RESPONSE && static_cast<ssize_t>(minbody) > target->max_response_size) throw ParseError("Max response body size exceeded");
Fixed Code
      if (minbody < 1) return true;
      if (target->kind == YAHTTP_TYPE_REQUEST && minbody > target->max_request_size) throw ParseError("Max request body size exceeded");
      else if (target->kind == YAHTTP_TYPE_RESPONSE && minbody > target->max_response_size) throw ParseError("Max response body size exceeded");

Vulnerability Existed: yes
TRUE POSITIVE
Incorrect chunk size parsing format string ext/yahttp/yahttp/reqresp.cpp Lines 175-180
Old Code
          if (sscanf(buf, "%x", &chunk_size) != 1) {
            throw ParseError("Unable to parse chunk size");
          }
Fixed Code
          if (sscanf(buf, "%zx", &chunk_size) != 1) {
            throw ParseError("Unable to parse chunk size");
          }

Vulnerability Existed: yes
TRUE POSITIVE
Chunked body length limit bypass ext/yahttp/yahttp/reqresp.cpp Lines 175-195
Old Code
          if (chunk_size > (std::numeric_limits<decltype(chunk_size)>::max() - 2)) {
            throw ParseError("Chunk is too large");
          }
...
          if (buffer.size() < static_cast<size_t>(chunk_size+1)) return false;
...
          std::string tmp = buffer.substr(0, chunk_size);
          buffer.erase(buffer.begin(), buffer.begin()+chunk_size+crlf);
          bodybuf << tmp;
Fixed Code
          if (chunk_size > (std::numeric_limits<decltype(chunk_size)>::max() - 2) || chunk_size > maxbody) {
            throw ParseError("Chunk is too large");
          }
...
          if (buffer.size() < chunk_size+1) return false;
...
          if (bodybuf.str().length() + chunk_size > maxbody) {
            throw ParseError("Chunked body is too large");
          }
          std::string tmp = buffer.substr(0, chunk_size);
          buffer.erase(buffer.begin(), buffer.begin()+chunk_size+crlf);
          bodybuf << tmp;

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

--- cache/pdns_rec-5.2.8/ext/yahttp/yahttp/reqresp.hpp	2026-04-29 05:56:10.170984596 +0000+++ cache/pdns_rec-5.2.9/ext/yahttp/yahttp/reqresp.hpp	2026-04-29 05:56:11.939110627 +0000@@ -20,6 +20,10 @@  #include <algorithm> +#ifndef YAHTTP_MAX_HEADER_SIZE+#define YAHTTP_MAX_HEADER_SIZE (100 * 1024)+#endif+ #ifndef YAHTTP_MAX_REQUEST_SIZE #define YAHTTP_MAX_REQUEST_SIZE 2097152 #endif@@ -108,6 +112,7 @@ #endif       max_request_size = YAHTTP_MAX_REQUEST_SIZE;       max_response_size = YAHTTP_MAX_RESPONSE_SIZE;+      max_header_size = YAHTTP_MAX_HEADER_SIZE;       url = "";       method = "";       statusText = "";@@ -130,6 +135,7 @@       this->parameters = rhs.parameters; this->getvars = rhs.getvars;       this->body = rhs.body; this->max_request_size = rhs.max_request_size;       this->max_response_size = rhs.max_response_size; this->version = rhs.version;+      this->max_header_size = rhs.max_header_size; #ifdef HAVE_CPP_FUNC_PTR       this->renderer = rhs.renderer; #endif@@ -143,6 +149,7 @@       this->parameters = rhs.parameters; this->getvars = rhs.getvars;       this->body = rhs.body; this->max_request_size = rhs.max_request_size;       this->max_response_size = rhs.max_response_size; this->version = rhs.version;+      this->max_header_size = rhs.max_header_size; #ifdef HAVE_CPP_FUNC_PTR       this->renderer = rhs.renderer; #endif@@ -166,8 +173,9 @@      std::string body; //<! the actual content -    ssize_t max_request_size; //<! maximum size of request-    ssize_t max_response_size;  //<! maximum size of response+    size_t max_request_size; //<! maximum size of request+    size_t max_response_size; //<! maximum size of response+    size_t max_header_size; //<! maximum size of headers     bool is_multipart; //<! if the request is multipart, prevents Content-Length header #ifdef HAVE_CPP_FUNC_PTR     funcptr::function<size_t(const HTTPBase*,std::ostream&,bool)> renderer; //<! rendering function@@ -301,10 +309,11 @@          std::string buffer; //<! read buffer      bool chunked; //<! whether we are parsing chunked data-    int chunk_size; //<! expected size of next chunk+    size_t chunk_size; //<! expected size of next chunk     std::ostringstream bodybuf; //<! buffer for body     size_t maxbody; //<! maximum size of body     size_t minbody; //<! minimum size of body+    size_t headersize;                      bool hasBody; //<! are we expecting body      void keyValuePair(const std::string &keyvalue, std::string &key, std::string &value); //<! key value pair parser helper@@ -315,6 +324,7 @@       pos = 0; state = 0; this->target = target_;       hasBody = false;       buffer = "";+      headersize = 0;       this->target->initialize();     }; //<! Initialize the parser for target and clear state     bool feed(const std::string& somedata); //<! Feed data to the parser

Vulnerability Existed: yes
TRUE POSITIVE
Denial of Service via unbounded HTTP header size ext/yahttp/yahttp/reqresp.hpp lines 20-24,108-112,130-135,143-149,301-324
Old Code
#include <algorithm>

#ifndef YAHTTP_MAX_REQUEST_SIZE
#define YAHTTP_MAX_REQUEST_SIZE 2097152
#endif

    ssize_t max_request_size; //<! maximum size of request
    ssize_t max_response_size;  //<! maximum size of response
    bool is_multipart; //<! if the request is multipart, prevents Content-Length header

    int chunk_size; //<! expected size of next chunk

    std::ostringstream bodybuf; //<! buffer for body
    size_t maxbody; //<! maximum size of body
    size_t minbody; //<! minimum size of body

    buffer = "";
    this->target->initialize();
Fixed Code
#include <algorithm>

#ifndef YAHTTP_MAX_HEADER_SIZE
#define YAHTTP_MAX_HEADER_SIZE (100 * 1024)
#endif

#ifndef YAHTTP_MAX_REQUEST_SIZE
#define YAHTTP_MAX_REQUEST_SIZE 2097152
#endif

    size_t max_request_size; //<! maximum size of request
    size_t max_response_size; //<! maximum size of response
    size_t max_header_size; //<! maximum size of headers
    bool is_multipart; //<! if the request is multipart, prevents Content-Length header

    size_t chunk_size; //<! expected size of next chunk

    std::ostringstream bodybuf; //<! buffer for body
    size_t maxbody; //<! maximum size of body
    size_t minbody; //<! minimum size of body
    size_t headersize;                 
    bool hasBody; //<! are we expecting body

    buffer = "";
    headersize = 0;
    this->target->initialize();
Vulnerability Existed: yes
TRUE POSITIVE
Integer signedness/overflow in HTTP parser size fields ext/yahttp/yahttp/reqresp.hpp lines 166-173,301-309
Old Code
    ssize_t max_request_size; //<! maximum size of request
    ssize_t max_response_size;  //<! maximum size of response
    bool is_multipart; //<! if the request is multipart, prevents Content-Length header

    std::string buffer; //<! read buffer 
    bool chunked; //<! whether we are parsing chunked data
    int chunk_size; //<! expected size of next chunk
    std::ostringstream bodybuf; //<! buffer for body
Fixed Code
    size_t max_request_size; //<! maximum size of request
    size_t max_response_size; //<! maximum size of response
    size_t max_header_size; //<! maximum size of headers
    bool is_multipart; //<! if the request is multipart, prevents Content-Length header

    std::string buffer; //<! read buffer 
    bool chunked; //<! whether we are parsing chunked data
    size_t chunk_size; //<! expected size of next chunk
    std::ostringstream bodybuf; //<! buffer for body

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.