Every CVE Search/ Get API key

CVE-2015-5470

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3...

7.8 HighFix available

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Exploit likelihood

11.3%Up 10.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
CVE-2015-5470
CVSS 2.0
7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
CVE-2015-5470
Updated
2026-11-02
EUVDEUVD-2015-5425 No score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
EUVD-2015-5425
Updated
2026-11-03
GitHub AdvisoriesGHSA-vh8j-jj36-28wq No score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3...

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
GHSA-vh8j-jj36-28wq
Updated
2026-11-02
OSV No score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
CVE-2015-5470
Updated
2026-11-02
OSVDEBIAN-CVE-2015-5470 No score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
DEBIAN-CVE-2015-5470
Updated
2026-11-02
OSVMGASA-2015-0301 No score

Updated pdns package fixes security vulnerability

In MGASA-2015-0189, the pdns and pdns-recursor packages were updated to fix a denial of service issue (CVE-2015-1868). The fix was incomplete. The packages have been updated again to versions 3.3.3 and 3.6.4, respectively, to completely fix this issue.

Record
MGASA-2015-0301
Updated
2026-11-02
OSVUBUNTU-CVE-2015-5470 No score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
UBUNTU-CVE-2015-5470
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pdns
Debian:12
 before 3.4.5-1
3.4.5-1
pdns
Debian:13
 before 3.4.5-1
3.4.5-1
pdns
Debian:14
 before 3.4.5-1
3.4.5-1
pdns-recursor
Debian:12
 before 3.7.3-1
3.7.3-1
pdns-recursor
Debian:13
 before 3.7.3-1
3.7.3-1
pdns-recursor
Debian:14
 before 3.7.3-1
3.7.3-1
pdns
Debian:8
 before 3.4.1-4+deb8u2, plus listed versions
3.4.1-43.4.1-4+deb8u13.4.1-4+deb8u1~bpo70+1
3.4.1-4+deb8u2
pdns-recursor
Debian:8
 before 3.6.2-2+deb8u2, plus listed versions
3.6.2-23.6.2-2+deb8u13.6.2-2+deb8u1~bpo70+13.6.2-2+deb8u2~bpo70+1
3.6.2-2+deb8u2
pdns
Mageia:4
From an advisory covering 2 CVEs
 before 3.3.3-1.mga4
3.3.3-1.mga4
pdns-recursor
Mageia:4
From an advisory covering 2 CVEs
 before 3.6.4-1.mga4
3.6.4-1.mga4
pdns
Mageia:5
From an advisory covering 2 CVEs
 before 3.3.3-1.mga5
3.3.3-1.mga5
pdns-recursor
Mageia:5
From an advisory covering 2 CVEs
 before 3.6.4-1.mga5
3.6.4-1.mga5
pdns-recursor
Ubuntu:14.04:LTS
 before 3.5.3-1ubuntu0.1, plus listed versions
3.3-33.5.3-1
3.5.3-1ubuntu0.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5470 is a high vulnerability (CVSS 7.8) in Powerdns Authoritative, published July 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.3%, the 95th percentile. Fixed in pdns 3.4.5-1.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open