Powerdns Recursor vulnerabilities, page 3
63 vulnerabilities
Known vulnerabilities in Powerdns Recursor, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-52690debianpdns-recursor+2
EPSS score0.43%
Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.CVE-2026-42388debianpdns-recursor+2EPSS score0.48%
Incomplete validation of the SOA record present in a catalog zone might lead to a crash.CVE-2026-42387debianpdns-recursor+2EPSS score0.48%
A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.CVE-2026-42390debianpdns-recursor+2EPSS score0.30%
An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.CVE-2026-42389debianpdns-recursor+2EPSS score0.30%
This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.CVE-2026-0398debianpdns-recursor+2EPSS score0.34%
Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.CVE-2026-24027debianpdns-recursor+2EPSS score0.45%
Crafted zones can lead to increased incoming network traffic.CVE-2026-33261debianpdns-recursor+2EPSS score0.23%
A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.CVE-2026-33259debianpdns-recursor+2EPSS score0.27%
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.CVE-2026-33601debianpdns-recursor+2EPSS score0.72%
If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.CVE-2026-33612debianpdns-recursor+2EPSS score0.15%
A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.CVE-2026-33258debianpdns-recursor+2EPSS score0.80%
By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.CVE-2026-33260debiandnsdist+8EPSS score1.06%
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.CVE-2026-33262debianpdns-recursor+2EPSS score0.46%
An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default.CVE-2026-33257debiandnsdist+8EPSS score1.06%
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.CVE-2026-33600debianpdns-recursor+2EPSS score0.72%
An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.CVE-2026-33256debianpdns-recursor+2EPSS score0.80%
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.CVE-2023-26437debianpdns-recursor+5EPSS score0.59%
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.CVE-2023-22617debianpdns-recursor+3EPSS score7.32%
A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName minimization is used in QM fallback mode. This is fixed in 4.8.1.CVE-2023-50868alpinebind+26EPSS score73.72%
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.