PowerDNS Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with PowerDNS products.
Products
- Recursor30 vulnerabilities
- DNSdist28 vulnerabilities
- Authoritative12 vulnerabilities
- PowerDNS Recursor3 vulnerabilities
- pdns2 vulnerabilities
- PowerDNS2 vulnerabilities
- authoritative_server1 vulnerability
- pdns-recursor1 vulnerability
- PowerDNS Authoritative1 vulnerability
- PowerDNS Authoritative Server1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-52688HIGH | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validationRRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation | CVSS7.5v3.1 | EPSS0.127% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Wildcard CNAME proof validation bypassThe issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record. CWE-347Jul 23, 2026 | CVSS3.7v3.1 | EPSS0.113% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning AttackIf the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records. Jul 23, 2026 | CVSS3.7v3.1 | EPSS0.143% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-42389MEDIUM | Reject more queries with invalid header valuesThis fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers. CWE-20Jun 25, 2026 | CVSS5.3v3.1 | EPSS0.175% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-52690MEDIUM | Spoofed answers can mark an authoritative non-EDNS capableSpoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail. CWE-290Jun 25, 2026 | CVSS5.9v3.1 | EPSS0.339% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42390MEDIUM | ZONEMD validation can be bypassedAn invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation. CWE-20Jun 25, 2026 | CVSS5.3v3.1 | EPSS0.205% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42388MEDIUM | Missing input validation for catalog zonesIncomplete validation of the SOA record present in a catalog zone might lead to a crash. CWE-20Jun 25, 2026 | CVSS5.9v3.1 | EPSS0.386% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42387MEDIUM | Insufficient input validation in ZoneToCacheA malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation. CWE-20Jun 25, 2026 | CVSS5.9v3.1 | EPSS0.386% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-40012MEDIUM | Information about ECS zero scoped answers might leak to clients that use a specific ECSECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled; CWE-524Jun 25, 2026 | CVSS5.3v3.1 | EPSS0.318% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33612HIGH | ZoneToCache can poison the cacheA malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning. CWE-349Jun 25, 2026 | CVSS7.5v3.1 | EPSS0.115% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Generated title:PowerDNS DNSdist EDNS Options Smuggling VulnerabilityAn attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter. CWE-115Jun 25, 2026 | CVSS3.7v3.1 | EPSS0.156% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-40211MEDIUM | Denial of service via crafted DoH3 queriesAn attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service. CWE-770Jun 25, 2026 | CVSS5.3v3.1 | EPSS0.296% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-40210MEDIUM | Out-of-bounds read in SetMacAddrActionAn out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash. CWE-126Jun 25, 2026 | CVSS4.8v3.1 | EPSS0.261% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-40209MEDIUM | Denial of service via IXFR queriesAn attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors. CWE-772Jun 25, 2026 | CVSS5.3v3.1 | EPSS0.29% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Denial of service via DoH3 queriesAn attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame. CWE-705Jun 25, 2026 | CVSS3.7v3.1 | EPSS0.205% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Prometheus denial of service via crafted DNS queriesAn attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires. CWE-116Jun 25, 2026 | CVSS3.7v3.1 | EPSS0.153% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-42005MEDIUM | Insufficient input validation of internal web serverAn attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. CWE-400Jun 25, 2026 | CVSS4.3v3.1 | EPSS0.344% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-41999MEDIUM | Incorrect Behaviour of Views with TCP PROXY RequestsIncorrect Behaviour of Views with TCP PROXY Requests CWE-284May 21, 2026 | CVSS4.8v3.1 | EPSS0.142% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42002MEDIUM | Concurrency and locking defects in GSS-TSIGConcurrency and locking defects in GSS-TSIG CWE-364May 21, 2026 | CVSS5.9v3.1 | EPSS0.264% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42001HIGH | Insufficient Validation of Autoprimary SOA QueriesInsufficient Validation of Autoprimary SOA Queries CWE-400May 21, 2026 | CVSS7.5v3.1 | EPSS0.365% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42000MEDIUM | Insufficient Validation of Names During AXFRInsufficient Validation of Names During AXFR CWE-77May 21, 2026 | CVSS6.8v3.1 | EPSS0.242% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42396MEDIUM | Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to FailInsufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail CWE-94May 21, 2026 | CVSS4.9v3.1 | EPSS0.353% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33611MEDIUM | Insufficient validation of HTTPS and SVCB recordsAn operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend. CWE-190Apr 22, 2026 | CVSS6.5v3.1 | EPSS0.423% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33610MEDIUM | Possible file descriptor exhaustion in forward-dnsupdateA rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it. CWE-400Apr 22, 2026 | CVSS5.9v3.1 | EPSS0.393% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33609MEDIUM | LDAP DN injectionIncomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees. CWE-90Apr 22, 2026 | CVSS5.3v3.1 | EPSS0.242% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |