Every CVE Search/ Get API key

CVE-2016-6172

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause...

6.8 MediumFix available

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.82%Up 2.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

Record
CVE-2016-6172
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0
7.1 HighAV:N/AC:M/Au:N/C:N/I:N/A:C
Weakness
CWE-400
Updated
2026-11-02
CVE List No score

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

Record
CVE-2016-6172
Updated
2026-11-02
EUVDEUVD-2016-7106 No score

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

Record
EUVD-2016-7106
Updated
2026-11-03
GitHub AdvisoriesGHSA-fr33-w8fm-p45j 6.8

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause...

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

Record
GHSA-fr33-w8fm-p45j
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 6.8

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

Record
CVE-2016-6172
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-6172 6.8

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

Record
DEBIAN-CVE-2016-6172
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2016-6172 6.8

PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.

Record
UBUNTU-CVE-2016-6172
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2016-0324 No score

Updated pdns packages fix security vulnerability

PowerDNS Authoritative Server accepts queries with a qname's length larger than 255 bytes (CVE-2016-5426). PowerDNS Authoritative Server does not properly handle dot inside labels (CVE-2016-5427). These issues allow a remote, unauthenticated attacker to cause an abnormal load on the PowerDNS backend by sending crafted DNS queries, which might result in a partial denial of service if the backend becomes overloaded.

It was found that PowerDNS does not implement reasonable restrictions for zone sizes. This allows an explicitly configured primary DNS server for a zone to crash a secondary DNS server, affecting service of other zones hosted on the same secondary server (CVE-2016-6172).

Record
MGASA-2016-0324
Updated
2026-11-02
OSVopenSUSE-SU-2024:10136-1 No score

pdns-4.0.1-1.2 on GA media

These are all security issues fixed in the pdns-4.0.1-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10136-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10537-1 No score

pdns-recursor-4.0.3-1.2 on GA media

These are all security issues fixed in the pdns-recursor-4.0.3-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10537-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pdns
Debian:12
 before 4.0.1-1
4.0.1-1
pdns
Debian:13
 before 4.0.1-1
4.0.1-1
pdns
Debian:14
 before 4.0.1-1
4.0.1-1
pdns
Debian:7
 before 3.1-4.1+deb7u2, plus listed versions
3.1-43.1-4.13.1-4.1+deb7u1
3.1-4.1+deb7u2
pdns
Debian:8
 before 3.4.1-4+deb8u6, plus listed versions
3.4.1-43.4.1-4+deb8u13.4.1-4+deb8u1~bpo70+13.4.1-4+deb8u23.4.1-4+deb8u33.4.1-4+deb8u43.4.1-4+deb8u5
3.4.1-4+deb8u6
pdns
Mageia:5
 before 3.3.3-1.2.mga5
3.3.3-1.2.mga5
pdns
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.4.5-1build23.4.6-23.4.6-33.4.7-13.4.7-2
Show 5 moreShow less
4.0.0~alpha1-14.0.0~alpha2-24.0.0~alpha2-34.0.0~alpha2-3build14.0.0~alpha2-3ubuntu0.1~esm1
 None known
pdns
openSUSE:Tumbleweed
 before 4.0.1-1.2
4.0.1-1.2
pdns-recursor
openSUSE:Tumbleweed
 before 4.0.3-1.2
4.0.3-1.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-6172 is a medium vulnerability (CVSS 6.8) in Powerdns Authoritative Server, published September 10, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.82%, the 90th percentile. Fixed in pdns 4.0.1-1.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open