CVE-2024-25583
Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- Record
CVE-2024-25583- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2024-22911
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- Record
EUVD-2024-22911- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rx5p-gx7r-2xj5
A crafted response from an upstream server the recursor has been configured to forward-recurse to...
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- Record
GHSA-rx5p-gx7r-2xj5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- Record
CVE-2024-25583- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-25583
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- Record
ALPINE-CVE-2024-25583- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- Record
CVE-2024-25583- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2024-25583
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- Record
DEBIAN-CVE-2024-25583- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-25583
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- Record
UBUNTU-CVE-2024-25583- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:0114-1 No score
Security update for pdns-recursor
This update for pdns-recursor fixes the following issues:
-
update to 4.8.8:
- fixes a case when a crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured (boo#1223262, CVE-2024-25583)
-
changes in 4.8.7:
- If serving stale, wipe CNAME records from cache when we get a NODATA negative response for them
- Fix the zoneToCache regression introduced by last security update
- Record
openSUSE-SU-2024:0114-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13901-1 No score
pdns-recursor-5.0.4-1.1 on GA media
These are all security issues fixed in the pdns-recursor-5.0.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13901-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorAlpine:v3.19 |
before 4.9.5-r0 | 4.9.5-r0 |
pdns-recursorAlpine:v3.20 |
before 5.0.4-r0 | 5.0.4-r0 |
pdns-recursorAlpine:v3.21 |
before 5.0.4-r0 | 5.0.4-r0 |
pdns-recursorAlpine:v3.22 |
before 5.0.4-r0 | 5.0.4-r0 |
pdns-recursorAlpine:v3.23 |
before 5.0.4-r0 | 5.0.4-r0 |
pdns-recursorAlpine:v3.24 |
before 5.0.4-r0 | 5.0.4-r0 |
pdns-recursorDebian:12 |
before 4.8.8-1, plus listed versions 4.8.4-14.8.6-14.8.7-1 |
4.8.8-1 |
pdns-recursorDebian:13 |
before 4.9.5-1 | 4.9.5-1 |
pdns-recursorDebian:14 |
before 4.9.5-1 | 4.9.5-1 |
pdns-recursorUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1 |
None known |
pdns-recursorUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1 |
None known |
pdns-recursorUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 4.4.2-34.6.0-1ubuntu14.6.0-1ubuntu1+esm1 |
None known |
pdns-recursorUbuntu:24.04:LTS |
All versions, plus listed versions 4.9.0-24.9.1-44.9.2-14.9.2-1build14.9.2-24.9.3-14.9.3-1build24.9.3-1build3 |
None known |
pdns-recursorSUSE:Package Hub 15 SP5 |
before 4.8.8-bp155.2.6.1 | 4.8.8-bp155.2.6.1 |
pdns-recursoropenSUSE:Leap 15.5 |
before 4.8.8-bp155.2.6.1 | 4.8.8-bp155.2.6.1 |
pdns-recursoropenSUSE:Tumbleweed |
before 5.0.4-1.1 | 5.0.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25583 is a high vulnerability (CVSS 7.5) in Powerdns Recursor, published April 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in pdns-recursor 4.9.5-r0.
References
doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-02.html
openwall.com/lists/oss-security/2024/04/24/1
nvd.nist.gov/vuln/detail/CVE-2024-25583
github.com/advisories/GHSA-rx5p-gx7r-2xj5
security.alpinelinux.org/vuln/CVE-2024-25583
repo.powerdns.com
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2024-25583
ubuntu.com/security/CVE-2024-25583
cve.org/CVERecord?id=CVE-2024-25583
lists.opensuse.org/archives/list/[email protected]/thread/ZZH2ONXJKWNVDG6IH66D5CLFDU6CHDXI
bugzilla.suse.com/1223262
suse.com/security/cve/CVE-2024-25583