CVE-2016-7068
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4...
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
- Record
CVE-2016-7068- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2016-7948
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
- Record
EUVD-2016-7948- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g832-5583-wc79
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4...
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
- Record
GHSA-g832-5583-wc79- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
- Record
CVE-2016-7068- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
OSV
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
- Record
CVE-2016-7068- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-7068
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
- Record
DEBIAN-CVE-2016-7068- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2016-7068
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
- Record
UBUNTU-CVE-2016-7068- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0033 No score
Updated pdns packages fix security vulnerabilities
Mathieu Lafon discovered that pdns does not properly validate records in zones. An authorized user can take advantage of this flaw to crash server by inserting a specially crafted record in a zone under their control and then sending a DNS query for that record (CVE-2016-2120).
Florian Heinz and Martin Kluge reported that pdns parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a partial denial of service if the system becomes overloaded (CVE-2016-7068).
Mongo discovered that the webserver in pdns is susceptible to a denial-of-service vulnerability. A remote, unauthenticated attacker to cause a denial of service by opening a large number of f TCP connections to the web server (CVE-2016-7072).
Mongo discovered that pdns does not sufficiently validate TSIG signatures, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR (CVE-2016-7073, CVE-2016-7074).
- Record
MGASA-2017-0033- Updated
- 2026-11-02
OSVMGASA-2017-0036 No score
Updated pdns-recursor packages fix security vulnerability
Florian Heinz and Martin Kluge reported that pdns-recursor parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a partial denial of service if the system becomes overloaded (CVE-2016-7068).
- Record
MGASA-2017-0036- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11156-1 No score
pdns-4.5.1-1.5 on GA media
These are all security issues fixed in the pdns-4.5.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11156-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11157-1 No score
pdns-recursor-4.5.5-1.3 on GA media
These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11157-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdnsDebian:12 |
before 4.0.2-1 | 4.0.2-1 |
pdnsDebian:13 |
before 4.0.2-1 | 4.0.2-1 |
pdnsDebian:14 |
before 4.0.2-1 | 4.0.2-1 |
pdns-recursorDebian:12 |
before 4.0.4-1 | 4.0.4-1 |
pdns-recursorDebian:13 |
before 4.0.4-1 | 4.0.4-1 |
pdns-recursorDebian:14 |
before 4.0.4-1 | 4.0.4-1 |
pdns-recursorDebian:7 |
before 3.3-3+deb7u2, plus listed versions 3.3-33.3-3+deb7u1 |
3.3-3+deb7u2 |
pdnsDebian:7 |
before 3.1-4.1+deb7u3, plus listed versions 3.1-43.1-4.13.1-4.1+deb7u13.1-4.1+deb7u2 |
3.1-4.1+deb7u3 |
pdns-recursorDebian:8 |
before 3.6.2-2+deb8u3, plus listed versions 3.6.2-23.6.2-2+deb8u13.6.2-2+deb8u1~bpo70+13.6.2-2+deb8u23.6.2-2+deb8u2~bpo70+1 |
3.6.2-2+deb8u3 |
pdnsDebian:8 |
before 3.4.1-4+deb8u7, plus listed versions 3.4.1-43.4.1-4+deb8u13.4.1-4+deb8u1~bpo70+13.4.1-4+deb8u23.4.1-4+deb8u33.4.1-4+deb8u43.4.1-4+deb8u53.4.1-4+deb8u6 |
3.4.1-4+deb8u7 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pdnsMageia:5 |
before 3.3.3-1.3.mga5 | 3.3.3-1.3.mga5 |
pdns-recursorMageia:5 |
before 3.6.4-1.1.mga5 | 3.6.4-1.1.mga5 |
pdns-recursorUbuntu:14.04:LTS |
before 3.5.3-1ubuntu0.1, plus listed versions 3.3-33.5.3-1 |
3.5.3-1ubuntu0.1 |
pdnsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.4.5-1build23.4.6-23.4.6-33.4.7-13.4.7-2 Show 5 moreShow less4.0.0~alpha1-14.0.0~alpha2-24.0.0~alpha2-34.0.0~alpha2-3build14.0.0~alpha2-3ubuntu0.1~esm1 |
None known |
pdns-recursorUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1 |
None known |
pdnsopenSUSE:Tumbleweed |
before 4.5.1-1.5 | 4.5.1-1.5 |
pdns-recursoropenSUSE:Tumbleweed |
before 4.5.5-1.3 | 4.5.5-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-7068 is a medium vulnerability (CVSS 5.3) in Powerdns Recursor, published January 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.29%, the 94th percentile. Fixed in pdns 4.0.2-1.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7068
debian.org/security/2017/dsa-3764
doc.powerdns.com/md/security/powerdns-advisory-2016-02
nvd.nist.gov/vuln/detail/CVE-2016-7068
github.com/advisories/GHSA-g832-5583-wc79
Show 40 moreShow less
security-tracker.debian.org/tracker/CVE-2016-7068
advisories.mageia.org/MGASA-2017-0033.html
bugs.mageia.org/show_bug.cgi?id=20126
ubuntu.com/security/CVE-2016-7068
cve.org/CVERecord?id=CVE-2016-7068
suse.com/security/cve/CVE-2006-2069