Powerdns Recursor vulnerabilities, page 2
63 vulnerabilities
Known vulnerabilities in Powerdns Recursor, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2014-8601debianpdns-recursor+4
EPSS score68.88%
PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance degradations") via a large or infinite number of referrals, as demonstrated by resolving domains hosted by ezdns.it.CVE-2008-1637debianpdns-recursor+1EPSS score3.96%
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.CVE-2008-3217debianpdns-recursor+1EPSS score1.81%
PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator for source port selection, which makes it easier for remote attack vectors to conduct DNS cache poisoning. NOTE: this is related to incomplete integration of security improvements associated with addressing CVE-2008-1637.CVE-2022-37428debianpdns-recursor+6EPSS score1.44%
PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query that leads to an answer with specific properties.CVE-2022-27227debianpdns+10EPSS score5.00%
In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1, insufficient validation of an IXFR end condition causes incomplete zone transfers to be handled as successful transfers.CVE-2017-15092debianpdns-recursor+3EPSS score2.27%
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.CVE-2017-15120debianpdns-recursor+4EPSS score51.35%
An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference when parsing a specially crafted answer containing a CNAME of a different class than IN. An unauthenticated remote attacker could cause a denial of service.CVE-2017-15094debianpdns-recursor+3EPSS score3.30%
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default).CVE-2017-15093debianpdns-recursor+3EPSS score0.83%
When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration.CVE-2017-15090debianpdns-recursor+3EPSS score0.71%
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.CVE-2024-25583debianpdns-recursor+5EPSS score0.83%
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.CVE-2024-25590debianpdns-recursor+3EPSS score0.70%
An attacker can publish a zone containing specific Resource Record Sets.
Repeatedly processing and caching results for these sets can lead to a
denial of service.CVE-2009-4009debianpdns-recursor+1EPSS score17.57%
Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted packets.CVE-2009-4010debianpdns-recursor+1EPSS score10.26%
Unspecified vulnerability in PowerDNS Recursor before 3.1.7.2 allows remote attackers to spoof DNS data via crafted zones.CVE-2019-3807debianpdns-recursor+4EPSS score0.37%
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.CVE-2019-3806debianpdns-recursor+3EPSS score1.45%
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.CVE-2026-40012debianpdns-recursor+2EPSS score0.45%
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;CVE-2026-52684debianpdns-recursor+2EPSS score0.22%
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the
child records are used immediately if not expired and thus valid, or the
records are expired, and in that case not used. So this case
can only happen if almost expired records are used to refresh the
authoritative NS records.CVE-2026-52686debianpdns-recursor+2EPSS score0.16%
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.CVE-2026-52688debianpdns-recursor+2EPSS score0.18%
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation