CVE-2023-26437
Deterred spoofing attempts can lead to authoritative servers being marked unavailable
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Deterred spoofing attempts can lead to authoritative servers being marked unavailable
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.
- Record
CVE-2023-26437- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2023-30257
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.
- Record
EUVD-2023-30257- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4wg5-gmxh-4r2r
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked...
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.
- Record
GHSA-4wg5-gmxh-4r2r- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.
- Record
CVE-2023-26437- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Deterred spoofing attempts can lead to authoritative servers being marked unavailable
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.
- Record
CVE-2023-26437- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-26437
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.
- Record
DEBIAN-CVE-2023-26437- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2023-26437
Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.
- Record
UBUNTU-CVE-2023-26437- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0101-1 No score
Security update for pdns-recursor
This update for pdns-recursor fixes the following issues:
pdns-recursor was updated to 4.6.6:
- fixes deterred spoofing attempts can lead to authoritative servers being marked unavailable (boo#1209897, CVE-2023-26437)
Fixes in 4.6.5:
- When an expired NSEC3 entry is seen, move it to the front of the expiry queue
- Log invalid RPZ content when obtained via IXFR
- Detect invalid bytes in makeBytesFromHex()
- Timeout handling for IXFRs as a client
Fixes in 4.6.4:
- Check qperq limit if throttling happened, as it increases counters
- Failure to retrieve DNSKEYs of an Insecure zone should not be fatal
- Resize answer length to actual received length in udpQueryResponse
- Record
openSUSE-SU-2023:0101-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:0048-1 No score
Security update for pdns-recursor
This update for pdns-recursor fixes the following issues:
Update to 4.8.6:
- fixes case when crafted DNSSEC records in a zone can lead to a denial of service in Recursor https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html (boo#1219823, boo#1219826, CVE-2023-50387, CVE-2023-50868)
Changes in 4.8.5:
- (I)XFR: handle partial read of len prefix.
- YaHTTP: Prevent integer overflow on very large chunks.
- Fix setting of policy tags for packet cache hits.
Changes in 4.8.4:
- Deterred spoofing attempts can lead to authoritative servers being marked unavailable (boo#1209897, CVE-2023-26437)
- Record
openSUSE-SU-2024:0048-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12838-1 No score
pdns-recursor-4.8.4-1.1 on GA media
These are all security issues fixed in the pdns-recursor-4.8.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12838-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorDebian:12 |
before 4.8.4-1 | 4.8.4-1 |
pdns-recursorDebian:13 |
before 4.8.4-1 | 4.8.4-1 |
pdns-recursorDebian:14 |
before 4.8.4-1 | 4.8.4-1 |
pdns-recursorUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1 |
None known |
pdns-recursorUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1 |
None known |
pdns-recursorUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1 |
None known |
pdns-recursorUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 4.4.2-34.6.0-1ubuntu14.6.0-1ubuntu1+esm1 |
None known |
pdns-recursorUbuntu:24.04:LTS |
All versions, plus listed versions 4.9.0-24.9.1-44.9.2-14.9.2-1build14.9.2-24.9.3-14.9.3-1build24.9.3-1build3 |
None known |
pdns-recursorUbuntu:25.10 |
All versions, plus listed versions 5.2.0-55.2.2-15.2.2-25.2.4-25.2.4-2build2 |
None known |
pdns-recursorUbuntu:26.10 |
All versions, plus listed versions 5.3.5-15.4.3-15.4.5-1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorUbuntu:26.04:LTS |
All versions, plus listed versions 5.2.4-2build25.3.1-15.3.3-15.3.4-15.3.4-1build15.3.4-25.3.5-1 |
None known |
pdns-recursorSUSE:Package Hub 15 SP4 |
before 4.6.6-bp154.2.6.1 | 4.6.6-bp154.2.6.1 |
pdns-recursoropenSUSE:Leap 15.4 |
before 4.6.6-bp154.2.6.1 | 4.6.6-bp154.2.6.1 |
pdns-recursorSUSE:Package Hub 15 SP5 From an advisory covering 3 CVEs |
before 4.8.6-bp155.2.3.1 | 4.8.6-bp155.2.3.1 |
pdns-recursoropenSUSE:Leap 15.5 From an advisory covering 3 CVEs |
before 4.8.6-bp155.2.3.1 | 4.8.6-bp155.2.3.1 |
pdns-recursoropenSUSE:Tumbleweed |
before 4.8.4-1.1 | 4.8.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-26437 is a low vulnerability (CVSS 3.4) in Powerdns Recursor, published April 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in pdns-recursor 4.8.4-1.
References
docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html
lists.fedoraproject.org/archives/list/[email protected]/message/CN7VMRYKZHG2UDUAK326LXD3JY7NO3LR
nvd.nist.gov/vuln/detail/CVE-2023-26437
github.com/advisories/GHSA-4wg5-gmxh-4r2r
Show 12 moreShow less
security-tracker.debian.org/tracker/CVE-2023-26437
ubuntu.com/security/CVE-2023-26437
doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html
cve.org/CVERecord?id=CVE-2023-26437
lists.opensuse.org/archives/list/[email protected]/thread/O77AR5R2DS34JA2Y3VBBU6V4IZWVEM56
bugzilla.suse.com/1209897
suse.com/security/cve/CVE-2023-26437