CVE-2016-7068: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2016-7068 is a high (CVSS 7.8) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 7.29% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 11-09-2018PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
CVSS metrics
6 scores · 5 sources · 2 versions- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
7.29%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 7.29% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian3 products
- pdns< 4.0.2-1
- pdns-recursor< 4.0.4-1 | < 3.6.2-2+deb8u3 | < 3.3-3+deb7u2
- debian_linuxEOL8.0
Alpine2 products
- pdns< 4.0.3-r0
- pdns-recursor< 4.0.4-r0
Powerdns2 products
- authoritative< 3.4.11 | ≥ 4.0.0, < 4.0.2
- recursor< 3.7.4 | ≥ 4.0.0, < 4.0.4
Ubuntu2 products
- pdnsAll versions (No fix recorded)
- pdns-recursor< 3.5.3-1ubuntu0.1 | All versions (No fix recorded)
Mageia1 product
- pdns-recursor< 3.6.4-1.1.mga5
Open-xchange1 product
- pdns3.4.11 | 4.0.2 | 3.7.4 | 4.0.4
6 vendors · 11 products
References
10 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7068X Refsource CONFIRMIssue TrackingThird Party Advisory
