CVE-2021-36754

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a...

7.5 HighFix available

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

64.9%Up 64.2 points since Jul 27, 2021

What each source reports

NVD Score used 7.5

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.

Record: CVE-2021-36754
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.

Record: CVE-2021-36754
Updated: 2026-11-02

EUVDEUVD-2021-23342 No score

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.

Record: EUVD-2021-23342
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g5x7-wx2c-jqff No score

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a...

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.

Record: GHSA-g5x7-wx2c-jqff
Weakness: CWE-119
Updated: 2026-11-02

OSVALPINE-CVE-2021-36754 7.5

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.

Record: ALPINE-CVE-2021-36754
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 7.5

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.

Record: CVE-2021-36754
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11156-1 No score

pdns-4.5.1-1.5 on GA media

These are all security issues fixed in the pdns-4.5.1-1.5 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11156-1
Updated: 2026-11-02

Affected products

powerdns authoritative server

Affected packages

Affected packages
Package	Affected	Fixed
`pdns` Alpine:v3.15	before 4.5.1-r0	4.5.1-r0
`pdns` Alpine:v3.16	before 4.5.1-r0	4.5.1-r0
`pdns` Alpine:v3.17	before 4.5.1-r0	4.5.1-r0
`pdns` Alpine:v3.18	before 4.5.1-r0	4.5.1-r0
`pdns` Alpine:v3.19	before 4.5.1-r0	4.5.1-r0
`pdns` Alpine:v3.20	before 4.5.1-r0	4.5.1-r0
`pdns` Alpine:v3.21	before 4.5.1-r0	4.5.1-r0
`pdns` Alpine:v3.22	before 4.5.1-r0	4.5.1-r0
`pdns` Alpine:v3.23	before 4.5.1-r0	4.5.1-r0
`pdns` Alpine:v3.24	before 4.5.1-r0	4.5.1-r0
`pdns` openSUSE:Tumbleweed	before 4.5.1-1.5	4.5.1-1.5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	PowerDNS Authoritative Server - Denial of Service

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-36754 is a high vulnerability (CVSS 7.5) in Powerdns Authoritative Server, published July 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 64.9%, the 99th percentile. Fixed in pdns 4.5.1-r0.

References

Show 16 moreShow less