CVE-2015-1868
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x...
CVE-2015-1868 is a high vulnerability (CVSS 7.8) in Powerdns Authoritative, published May 5, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 78.7%, the 99th percentile. Fixed in pdns 3.4.4-1.
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
Exploit likelihood
What each source reports
NVD Score used
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
- Record
CVE-2015-1868- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
- Record
CVE-2015-1868- Updated
- 2026-11-02
EUVDEUVD-2015-1974 No score
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
- Record
EUVD-2015-1974- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9r88-88v4-3j6c No score
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x...
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
- Record
GHSA-9r88-88v4-3j6c- Updated
- 2026-11-02
OSV No score
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
- Record
CVE-2015-1868- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-1868 No score
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
- Record
DEBIAN-CVE-2015-1868- Updated
- 2026-11-02
Show 5 moreShow less
OSVMGASA-2015-0189 No score
Updated pdns & pdns-recursor packages fix CVE-2015-1868
Updated pdns and pdns-recursor packages fix security vulnerability:
A bug was discovered in the label decompression code in PowerDNS and PowerDNS Recursor, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to cause crashes. On all platforms, this bug can be abused to cause service-affecting CPU spikes (CVE-2015-1868).
The pdns package has been updated to version 3.3.2 and the pdns-recursor package has been updated to version 3.6.3 to fix this issue and other bugs.
- Record
MGASA-2015-0189- Updated
- 2026-11-02
OSVMGASA-2015-0301 No score
Updated pdns package fixes security vulnerability
In MGASA-2015-0189, the pdns and pdns-recursor packages were updated to fix a denial of service issue (CVE-2015-1868). The fix was incomplete. The packages have been updated again to versions 3.3.3 and 3.6.4, respectively, to completely fix this issue.
- Record
MGASA-2015-0301- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10136-1 No score
pdns-4.0.1-1.2 on GA media
These are all security issues fixed in the pdns-4.0.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10136-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10537-1 No score
pdns-recursor-4.0.3-1.2 on GA media
These are all security issues fixed in the pdns-recursor-4.0.3-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10537-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1868 No score
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
- Record
UBUNTU-CVE-2015-1868- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdnsDebian:12 |
before 3.4.4-1 | 3.4.4-1 |
pdnsDebian:13 |
before 3.4.4-1 | 3.4.4-1 |
pdnsDebian:14 |
before 3.4.4-1 | 3.4.4-1 |
pdns-recursorDebian:12 |
before 3.7.2-1 | 3.7.2-1 |
pdns-recursorDebian:13 |
before 3.7.2-1 | 3.7.2-1 |
pdns-recursorDebian:14 |
before 3.7.2-1 | 3.7.2-1 |
pdnsMageia:4 |
before 3.3.2-1.mga4 | 3.3.2-1.mga4 |
pdns-recursorMageia:4 |
before 3.6.3-1.mga4 | 3.6.3-1.mga4 |
pdnsMageia:4 |
before 3.3.3-1.mga4 | 3.3.3-1.mga4 |
pdns-recursorMageia:4 |
before 3.6.4-1.mga4 | 3.6.4-1.mga4 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pdnsMageia:5 |
before 3.3.3-1.mga5 | 3.3.3-1.mga5 |
pdns-recursorMageia:5 |
before 3.6.4-1.mga5 | 3.6.4-1.mga5 |
pdnsUbuntu:14.04:LTS |
before 3.3-2ubuntu0.1, plus listed versions 3.1-4build13.3-13.3-2 |
3.3-2ubuntu0.1 |
pdns-recursorUbuntu:14.04:LTS |
before 3.5.3-1ubuntu0.1, plus listed versions 3.3-33.5.3-1 |
3.5.3-1ubuntu0.1 |
pdnsopenSUSE:Tumbleweed |
before 4.0.1-1.2 | 4.0.1-1.2 |
pdns-recursoropenSUSE:Tumbleweed |
before 4.0.3-1.2 | 4.0.3-1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.fedoraproject.org/pipermail/package-announce/2015-April/156648.html
securityfocus.com/bid/74306
Show 25 moreShow less
debian.org/security/2015/dsa-3306
securitytracker.com/id/1032220
nvd.nist.gov/vuln/detail/CVE-2015-1868
github.com/advisories/GHSA-9r88-88v4-3j6c
security-tracker.debian.org/tracker/CVE-2015-1868
advisories.mageia.org/MGASA-2015-0189.html
bugs.mageia.org/show_bug.cgi?id=15754
doc.powerdns.com/md/security/powerdns-advisory-2015-01
blog.powerdns.com/2015/05/01/important-update-for-security-advisory-2015-01
openwall.com/lists/oss-security/2015/07/10/8
lists.opensuse.org/opensuse-updates/2015-07/msg00049.html
ubuntu.com/security/CVE-2015-1868
cve.org/CVERecord?id=CVE-2015-1868
suse.com/security/cve/CVE-2012-0206