CVE-2016-5426

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial...

7.5 HighFix available

CVE-2016-5426 is a high vulnerability (CVSS 7.5) in Powerdns Authoritative, published September 10, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 30.6%, the 98th percentile. Fixed in pdns 4.0.0~alpha1-1.

What does this mean?

Severity: 7.5 HighCVSS 3.0, NVD
Exploit chance: 30.6%EPSS, 98th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 4.0.0~alpha1-1pdns +5 more

Description

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

30.6%Up 29.3 points since Feb 4, 2022

Affected products

powerdns authoritative

Affected packages

Affected packages
Package	Affected	Fixed
`pdns` Debian:12	before 4.0.0~alpha1-1	4.0.0~alpha1-1
`pdns` Debian:13	before 4.0.0~alpha1-1	4.0.0~alpha1-1
`pdns` Debian:14	before 4.0.0~alpha1-1	4.0.0~alpha1-1
`pdns` Debian:7 From an advisory covering 3 CVEs	before 3.1-4.1+deb7u2, plus listed versions 3.1-43.1-4.13.1-4.1+deb7u1	3.1-4.1+deb7u2
`pdns` Debian:8 From an advisory covering 3 CVEs	before 3.4.1-4+deb8u6, plus listed versions 3.4.1-43.4.1-4+deb8u13.4.1-4+deb8u1~bpo70+13.4.1-4+deb8u23.4.1-4+deb8u33.4.1-4+deb8u43.4.1-4+deb8u5	3.4.1-4+deb8u6
`pdns` Mageia:5 From an advisory covering 3 CVEs	before 3.3.3-1.2.mga5	3.3.3-1.2.mga5

What each source reports

NVD Score used7.5

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.

Record: CVE-2016-5426
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-399
Updated: 2026-11-02

CVE ListNo score

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.

Record: CVE-2016-5426
Updated: 2026-11-02

EUVDEUVD-2016-6371No score

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.

Record: EUVD-2016-6371
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ghrw-639j-38vq7.5

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial...

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.

Record: GHSA-ghrw-639j-38vq
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV7.5

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.

Record: CVE-2016-5426
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-54267.5

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.

Record: DEBIAN-CVE-2016-5426
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-54267.5

PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.

Record: UBUNTU-CVE-2016-5426
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2016-0324No score

Updated pdns packages fix security vulnerability

PowerDNS Authoritative Server accepts queries with a qname's length larger than 255 bytes (CVE-2016-5426). PowerDNS Authoritative Server does not properly handle dot inside labels (CVE-2016-5427). These issues allow a remote, unauthenticated attacker to cause an abnormal load on the PowerDNS backend by sending crafted DNS queries, which might result in a partial denial of service if the backend becomes overloaded.

It was found that PowerDNS does not implement reasonable restrictions for zone sizes. This allows an explicitly configured primary DNS server for a zone to crash a secondary DNS server, affecting service of other zones hosted on the same secondary server (CVE-2016-6172).

Record: MGASA-2016-0324
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 9 moreShow less