Powerdns Recursor vulnerabilities

CVE-2026-33257 [HIGH] CWE-770 CVE-2026-33257: An attacker can send a web request that causes unlimited memory allocation in the internal web serve An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVE-2015-5470 [HIGH] CVE-2015-5470: The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and A The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for C

CVE-2019-3806 [HIGH] CWE-358 CVE-2019-3806: An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are n An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.

CVE-2025-59030 [HIGH] CWE-276 CVE-2025-59030: An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP. An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.

CVE-2026-33258 [HIGH] CWE-770 CVE-2026-33258: By publishing and querying a crafted zone an attacker can cause allocation of large entries in the n By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.

CVE-2020-10995 [HIGH] CWE-400 CVE-2020-10995: PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplific PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the result

CVE-2018-10851 [HIGH] CWE-400 CVE-2018-10851: PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service.

CVE-2024-25583 [HIGH] CWE-20 CVE-2024-25583: A crafted response from an upstream server the recursor has been configured to forward-recurse to ca A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.

CVE-2025-30195 [HIGH] CWE-476 CVE-2025-30195: An attacker can publish a zone containing specific Resource Record Sets. Processing and caching resu An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service. The remedy is: upgrade to the patched 5.2.1 version. We would like to thank Volodymyr Ilyin for bringing this issue to our attention.

CVE-2024-25590 [HIGH] CWE-20 CVE-2024-25590: An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can lead to a denial of service.

CVE-2025-59024 [MEDIUM] CWE-345 CVE-2025-59024: Crafted delegations or IP fragments can poison cached delegations in Recursor. Crafted delegations or IP fragments can poison cached delegations in Recursor.

CVE-2018-14626 [HIGH] CWE-400 CVE-2018-14626: PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 in PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via crafted query that can lead to denial of service.

CVE-2018-14644 [MEDIUM] CWE-20 CVE-2018-14644: An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached as failing DNSSEC validation. It only arises if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for a

CVE-2026-42387 [MEDIUM] CWE-20 CVE-2026-42387: A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.

CVE-2022-37428 [MEDIUM] CWE-459 CVE-2022-37428: PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query that leads to an answer with specific properties.

CVE-2017-15094 [MEDIUM] CWE-401 CVE-2017-15094: An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and includi An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default).

CVE-2016-7073 [MEDIUM] CWE-20 CVE-2016-7073: An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, all An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever, leading to a possible replay attack.

CVE-2017-15090 [MEDIUM] CWE-347 CVE-2017-15090: An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuin

CVE-2026-52690 [MEDIUM] CWE-290 CVE-2026-52690: Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, cau Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.

CVE-2020-14196 [MEDIUM] CWE-863 CVE-2020-14196: In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting acces In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.