Powerdns vulnerabilities, page 4
129 vulnerabilities
Known vulnerabilities in Powerdns products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.
CVE-2024-25581debiandnsdist+2
EPSS score1.08%
When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default.CVE-2009-4009debianpdns-recursor+1EPSS score17.57%
Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted packets.CVE-2009-4010debianpdns-recursor+1EPSS score10.26%
Unspecified vulnerability in PowerDNS Recursor before 3.1.7.2 allows remote attackers to spoof DNS data via crafted zones.CVE-2019-10163debianpdns+5EPSS score1.00%
A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.CVE-2019-10162debianpdns+4EPSS score1.69%
A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.CVE-2019-10203debianpdns+3EPSS score1.55%
PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2^32-1 while trying to notify a slave leads to DoS.CVE-2019-3807debianpdns-recursor+4EPSS score0.37%
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.CVE-2019-3871debianpdns+8EPSS score12.63%
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the responseCVE-2019-3806debianpdns-recursor+3EPSS score1.45%
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.CVE-2026-40211debiandnsdist+2EPSS score0.70%
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.CVE-2026-40209debiandnsdist+2EPSS score0.70%
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.CVE-2026-40011debiandnsdist+2EPSS score0.22%
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.CVE-2026-40210debiandnsdist+2EPSS score0.74%
An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.CVE-2026-40208debiandnsdist+2EPSS score0.40%
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.CVE-2026-40012debianpdns-recursor+2EPSS score0.45%
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;CVE-2026-52684debianpdns-recursor+2EPSS score0.22%
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the
child records are used immediately if not expired and thus valid, or the
records are expired, and in that case not used. So this case
can only happen if almost expired records are used to refresh the
authoritative NS records.CVE-2026-52686debianpdns-recursor+2EPSS score0.16%
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.CVE-2026-52688debianpdns-recursor+2EPSS score0.18%
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validationCVE-2026-52690debianpdns-recursor+2EPSS score0.43%
Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.CVE-2026-41999debianpdns+2EPSS score0.19%
Incorrect Behaviour of Views with TCP PROXY Requests