DNSCrypt Vulnerability Allows Remote Crash via Crafted Queries

The National Vulnerability Database has identified CVE-2026-33593, a critical vulnerability impacting DNSCrypt clients. Attackers can exploit this by sending a specially crafted DNSCrypt query, triggering a divide-by-zero error that leads to a client crash. The exploit requires no authentication or user interaction and can be launched remotely over the network, making it a significant threat.

With a CVSS score of 7.5 (HIGH), this vulnerability presents a direct denial-of-service risk. While specific affected products are not detailed by the National Vulnerability Database, any implementation of DNSCrypt that does not properly sanitize incoming query data is potentially at risk. Defenders should prioritize verifying the security posture of their DNSCrypt deployments and consider implementing network-level filtering if possible to block malformed queries.

The ease of exploitation – requiring only network access and the ability to send a crafted query – means this could be weaponized by unsophisticated attackers. CISOs should ensure their teams are aware of this flaw and are actively patching or updating any vulnerable DNSCrypt clients to prevent disruption. The attacker’s calculus here is simple: cause outages with minimal effort.