CVE-2016-5427

PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside...

7.5 HighFix available

PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of service (backend CPU consumption) via a crafted DNS query.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

63.0%Up 61.7 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2016-5427
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-399
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-5427
Updated: 2026-11-02

EUVDEUVD-2016-6372 No score

Record: EUVD-2016-6372
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8c2c-pfjh-2jc2 7.5

PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside...

Record: GHSA-8c2c-pfjh-2jc2
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

Record: CVE-2016-5427
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-5427 7.5

Record: DEBIAN-CVE-2016-5427
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-5427 7.5

Record: UBUNTU-CVE-2016-5427
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2016-0324 No score

Updated pdns packages fix security vulnerability

PowerDNS Authoritative Server accepts queries with a qname's length larger than 255 bytes (CVE-2016-5426). PowerDNS Authoritative Server does not properly handle dot inside labels (CVE-2016-5427). These issues allow a remote, unauthenticated attacker to cause an abnormal load on the PowerDNS backend by sending crafted DNS queries, which might result in a partial denial of service if the backend becomes overloaded.

It was found that PowerDNS does not implement reasonable restrictions for zone sizes. This allows an explicitly configured primary DNS server for a zone to crash a secondary DNS server, affecting service of other zones hosted on the same secondary server (CVE-2016-6172).

Record: MGASA-2016-0324
Updated: 2026-11-02

Affected products

powerdns authoritative

Affected packages

Affected packages
Package	Affected	Fixed
`pdns` Debian:12	before 4.0.0~alpha1-1	4.0.0~alpha1-1
`pdns` Debian:13	before 4.0.0~alpha1-1	4.0.0~alpha1-1
`pdns` Debian:14	before 4.0.0~alpha1-1	4.0.0~alpha1-1
`pdns` Debian:7 From an advisory covering 3 CVEs	before 3.1-4.1+deb7u2, plus listed versions 3.1-43.1-4.13.1-4.1+deb7u1	3.1-4.1+deb7u2
`pdns` Debian:8 From an advisory covering 3 CVEs	before 3.4.1-4+deb8u6, plus listed versions 3.4.1-43.4.1-4+deb8u13.4.1-4+deb8u1~bpo70+13.4.1-4+deb8u23.4.1-4+deb8u33.4.1-4+deb8u43.4.1-4+deb8u5	3.4.1-4+deb8u6
`pdns` Mageia:5 From an advisory covering 3 CVEs	before 3.3.3-1.2.mga5	3.3.3-1.2.mga5

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-5427 is a high vulnerability (CVSS 7.5) in Powerdns Authoritative, published September 10, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 63.0%, the 99th percentile. Fixed in pdns 4.0.0~alpha1-1.

References

Show 9 moreShow less