{"id":"CVE-2016-7072","aliases":["DEBIAN-CVE-2016-7072","DLA-798-1","DSA-3764-1","EUVD-2016-7952","GHSA-64pc-8jh2-hf6v","MGASA-2017-0033","UBUNTU-CVE-2016-7072","openSUSE-SU-2024:11156-1"],"status":"published","title":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a...","description":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0615,"percentile":0.93512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-400"],"published":"2017-01-13T00:00:00Z","modified":"2026-10-24T10:30:36Z","fixes":[{"ecosystem":"Debian:12","package":"pdns","fixed_in":["4.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pdns","fixed_in":["4.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pdns","fixed_in":["4.0.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-4.1+deb7u3"}]}],"versions":["3.1-4","3.1-4.1","3.1-4.1+deb7u1","3.1-4.1+deb7u2"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-4+deb8u7"}]}],"versions":["3.4.1-4","3.4.1-4+deb8u1","3.4.1-4+deb8u1~bpo70+1","3.4.1-4+deb8u2","3.4.1-4+deb8u3","3.4.1-4+deb8u4","3.4.1-4+deb8u5","3.4.1-4+deb8u6"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1.3.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.5-1build2","3.4.6-2","3.4.6-3","3.4.7-1","3.4.7-2","4.0.0~alpha1-1","4.0.0~alpha2-2","4.0.0~alpha2-3","4.0.0~alpha2-3build1","4.0.0~alpha2-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1.5"}]}],"bundled":16}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"debian","product":"pdns"},{"vendor":"open-xchange","product":"pdns"},{"vendor":"powerdns","product":"authoritative"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7072","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.debian.org/security/2017/dsa-3764","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7072"},{"url":"https://github.com/advisories/GHSA-64pc-8jh2-hf6v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7072","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0033.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20126","tags":["report"]},{"url":"https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/","tags":["web"]},{"url":"https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/","tags":["web"]},{"url":"https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7072","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36754","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-7072","description":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.","status":"published","published":"2018-09-10T17:00:00Z","modified":"2024-08-06T01:50:47.436Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:33:36.802481Z"}],"euvd":[{"id":"EUVD-2016-7952","description":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.","status":"published","published":"2018-09-10T17:00:00Z","modified":"2024-08-06T01:50:47Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T02:22:34.032839Z"}],"ghsa":[{"id":"GHSA-64pc-8jh2-hf6v","title":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a...","description":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.","status":"published","published":"2022-05-13T01:38:41Z","modified":"2023-02-01T05:09:18Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:50:56.168791Z"}],"nvd":[{"id":"CVE-2016-7072","description":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.","status":"published","published":"2018-09-10T17:29:00.193Z","modified":"2026-06-17T00:52:32.463Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-400"],"updated_at":"2026-11-02T14:03:39.621168Z"}],"osv":[{"id":"CVE-2016-7072","description":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.","status":"published","published":"2018-09-10T17:29:00.193Z","modified":"2026-10-24T10:30:36.75342704Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-7072","description":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.","status":"published","published":"2018-09-10T17:29:00.193Z","modified":"2026-09-22T07:02:09.596177321Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-7072","description":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.","status":"published","published":"2018-09-10T17:29:00Z","modified":"2025-09-08T16:43:50Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"DLA-798-1","title":"pdns - security update","status":"published","published":"2017-01-25T00:00:00Z","modified":"2026-03-09T02:10:24.327657Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3764-1","title":"pdns - security update","status":"published","published":"2017-01-13T00:00:00Z","modified":"2026-03-09T01:23:38.424677Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0033","title":"Updated pdns packages fix security vulnerabilities","description":"Mathieu Lafon discovered that pdns does not properly validate records\nin zones. An authorized user can take advantage of this flaw to crash\nserver by inserting a specially crafted record in a zone under their\ncontrol and then sending a DNS query for that record (CVE-2016-2120).\n\nFlorian Heinz and Martin Kluge reported that pdns parses all records\npresent in a query regardless of whether they are needed or even\nlegitimate, allowing a remote, unauthenticated attacker to cause an\nabnormal CPU usage load on the pdns server, resulting in a partial\ndenial of service if the system becomes overloaded (CVE-2016-7068).\n\nMongo discovered that the webserver in pdns is susceptible to a\ndenial-of-service vulnerability. A remote, unauthenticated attacker to\ncause a denial of service by opening a large number of f TCP\nconnections to the web server (CVE-2016-7072).\n\nMongo discovered that pdns does not sufficiently validate TSIG\nsignatures, allowing an attacker in position of man-in-the-middle to\nalter the content of an AXFR (CVE-2016-7073, CVE-2016-7074).\n","status":"published","published":"2017-02-02T08:11:52Z","modified":"2026-04-16T06:23:45.973195639Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11156-1","title":"pdns-4.5.1-1.5 on GA media","description":"These are all security issues fixed in the pdns-4.5.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:39:47.285231Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}