Every CVESearch/Get API key

CVE-2015-5470

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3...

7.8 HighFix available

CVE-2015-5470 is a high vulnerability (CVSS 7.8) in Powerdns Authoritative, published July 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.3%, the 96th percentile. Fixed in pdns 3.4.5-1.

What does this mean?
Severity
7.8 HighCVSS 2.0, NVD
Exploit chance
11.3%EPSS, 96th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.4.5-1pdns +12 more

Description

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Exploit likelihood

11.3%Up 10.1 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pdns
Debian:12
before 3.4.5-1
3.4.5-1
pdns
Debian:13
before 3.4.5-1
3.4.5-1
pdns
Debian:14
before 3.4.5-1
3.4.5-1
pdns-recursor
Debian:12
before 3.7.3-1
3.7.3-1
pdns-recursor
Debian:13
before 3.7.3-1
3.7.3-1
pdns-recursor
Debian:14
before 3.7.3-1
3.7.3-1
pdns
Debian:8
before 3.4.1-4+deb8u2, plus listed versions
3.4.1-43.4.1-4+deb8u13.4.1-4+deb8u1~bpo70+1
3.4.1-4+deb8u2
pdns-recursor
Debian:8
before 3.6.2-2+deb8u2, plus listed versions
3.6.2-23.6.2-2+deb8u13.6.2-2+deb8u1~bpo70+13.6.2-2+deb8u2~bpo70+1
3.6.2-2+deb8u2
pdns
Mageia:4
From an advisory covering 2 CVEs
before 3.3.3-1.mga4
3.3.3-1.mga4
pdns-recursor
Mageia:4
From an advisory covering 2 CVEs
before 3.6.4-1.mga4
3.6.4-1.mga4
pdns
Mageia:5
From an advisory covering 2 CVEs
before 3.3.3-1.mga5
3.3.3-1.mga5
pdns-recursor
Mageia:5
From an advisory covering 2 CVEs
before 3.6.4-1.mga5
3.6.4-1.mga5
pdns-recursor
Ubuntu:14.04:LTS
before 3.5.3-1ubuntu0.1, plus listed versions
3.3-33.5.3-1
3.5.3-1ubuntu0.1

What each source reports

NVD Score used7.8

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
CVE-2015-5470
CVSS 2.0
7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness
CWE-399
Updated
2026-11-02
CVE ListNo score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
CVE-2015-5470
Updated
2026-11-02
EUVDEUVD-2015-5425No score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
EUVD-2015-5425
Updated
2026-11-03
GitHub AdvisoriesGHSA-vh8j-jj36-28wqNo score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3...

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
GHSA-vh8j-jj36-28wq
Updated
2026-11-02
OSVNo score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
CVE-2015-5470
Updated
2026-11-02
OSVDEBIAN-CVE-2015-5470No score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
DEBIAN-CVE-2015-5470
Updated
2026-11-02
OSVMGASA-2015-0301No score

Updated pdns package fixes security vulnerability

In MGASA-2015-0189, the pdns and pdns-recursor packages were updated to fix a denial of service issue (CVE-2015-1868). The fix was incomplete. The packages have been updated again to versions 3.3.3 and 3.6.4, respectively, to completely fix this issue.

Record
MGASA-2015-0301
Updated
2026-11-02
OSVUBUNTU-CVE-2015-5470No score

The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.

Record
UBUNTU-CVE-2015-5470
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 8 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open