{"id":"CVE-2015-1868","aliases":["DEBIAN-CVE-2015-1868","EUVD-2015-1974","GHSA-9r88-88v4-3j6c","MGASA-2015-0189","MGASA-2015-0301","UBUNTU-CVE-2015-1868","openSUSE-SU-2024:10136-1","openSUSE-SU-2024:10537-1"],"status":"published","title":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x...","description":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.","severity":{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.78725,"percentile":0.99592,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2015-05-05T13:36:50Z","modified":"2026-09-09T06:47:30Z","fixes":[{"ecosystem":"Debian:12","package":"pdns","fixed_in":["3.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pdns","fixed_in":["3.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pdns","fixed_in":["3.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pdns-recursor","fixed_in":["3.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pdns-recursor","fixed_in":["3.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pdns-recursor","fixed_in":["3.7.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"pdns","fixed_in":["3.3.2-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"pdns-recursor","fixed_in":["3.6.3-1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"pdns","fixed_in":["3.3-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"pdns-recursor","fixed_in":["3.5.3-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.3-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-2ubuntu0.1"}]}],"versions":["3.1-4build1","3.3-1","3.3-2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu0.1"}]}],"versions":["3.3-3","3.5.3-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-1.2"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1.2"}]}],"bundled":4}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"powerdns","product":"authoritative"},{"vendor":"powerdns","product":"recursor"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156648.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156725.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156743.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/74306","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156655.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156680.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3306","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3307","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1032220","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156667.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1868"},{"url":"https://github.com/advisories/GHSA-9r88-88v4-3j6c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1868","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0189.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15754","tags":["report"]},{"url":"http://doc.powerdns.com/md/security/powerdns-advisory-2015-01/","tags":["web"]},{"url":"http://blog.powerdns.com/2015/05/01/important-update-for-security-advisory-2015-01/","tags":["advisory"]},{"url":"https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-332","tags":["web"]},{"url":"https://doc.powerdns.com/md/changelog/#powerdns-recursor-363","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0301.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16320","tags":["report"]},{"url":"http://blog.powerdns.com/2015/06/09/authoritative-server-3-4-5-3-3-3-and-recursor-3-7-3-3-6-4-released/","tags":["web"]},{"url":"http://advisories.mageia.org/MGASA-2015-0189.html","tags":["advisory"]},{"url":"http://openwall.com/lists/oss-security/2015/07/10/8","tags":["web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00049.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-1868","tags":["report"]},{"url":"https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1868","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8601","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-1868","description":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.","status":"published","published":"2015-05-18T15:00:00Z","modified":"2024-08-06T04:54:16.393Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1974","description":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.","status":"published","published":"2015-05-18T15:00:00Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:14.212001Z"}],"ghsa":[{"id":"GHSA-9r88-88v4-3j6c","title":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x...","description":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.","status":"published","published":"2022-05-17T03:15:10Z","modified":"2023-01-27T05:06:32Z","updated_at":"2026-11-02T14:42:56.089114Z"}],"nvd":[{"id":"CVE-2015-1868","description":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.","status":"published","published":"2015-05-18T15:59:05.823Z","modified":"2026-06-17T00:23:08.72Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"CVE-2015-1868","description":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.","status":"published","published":"2015-05-18T15:59:05Z","modified":"2026-04-16T06:20:20.220283888Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-1868","description":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.","status":"published","published":"2015-05-18T15:59:05.823Z","modified":"2026-09-09T06:47:30.05696635Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0189","title":"Updated pdns \u0026 pdns-recursor packages fix CVE-2015-1868","description":"Updated pdns and pdns-recursor packages fix security vulnerability:\n\nA bug was discovered in the label decompression code in PowerDNS and PowerDNS\nRecursor, making it possible for names to refer to themselves, thus causing a\nloop during decompression. On some platforms, this bug can be abused to cause\ncrashes. On all platforms, this bug can be abused to cause service-affecting\nCPU spikes (CVE-2015-1868).\n\nThe pdns package has been updated to version 3.3.2 and the pdns-recursor\npackage has been updated to version 3.6.3 to fix this issue and other bugs.\n","status":"published","published":"2015-05-05T13:36:50Z","modified":"2026-04-16T06:23:14.159426761Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0301","title":"Updated pdns package fixes security vulnerability","description":"In MGASA-2015-0189, the pdns and pdns-recursor packages were updated to\nfix a denial of service issue (CVE-2015-1868).  The fix was incomplete.\nThe packages have been updated again to versions 3.3.3 and 3.6.4,\nrespectively, to completely fix this issue.\n","status":"published","published":"2015-08-03T20:55:18Z","modified":"2026-04-16T06:22:20.602163817Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10136-1","title":"pdns-4.0.1-1.2 on GA media","description":"These are all security issues fixed in the pdns-4.0.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:33:27.821694Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10537-1","title":"pdns-recursor-4.0.3-1.2 on GA media","description":"These are all security issues fixed in the pdns-recursor-4.0.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:13:09.984599Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2015-1868","description":"The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.","status":"published","published":"2015-05-18T15:59:00Z","modified":"2025-09-08T16:43:20Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}