{"id":"CVE-2025-30195","aliases":["ALPINE-CVE-2025-30195","DEBIAN-CVE-2025-30195","EUVD-2025-10022","GHSA-v9gv-mwp4-wx7g","UBUNTU-CVE-2025-30195"],"status":"published","title":"A crafted zone can lead to an illegal memory access in the PowerDNS Recursor","description":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.\n\nThe remedy is: upgrade to the patched 5.2.1 version.\n\nWe would like to thank Volodymyr Ilyin for bringing this issue to our attention.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00791,"percentile":0.5679,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2025-04-07T13:24:17Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"pdns-recursor","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"pdns-recursor","fixed_in":["5.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"pdns-recursor","fixed_in":["5.2.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pdns-recursor","fixed_in":["5.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pdns-recursor","fixed_in":["5.2.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-1","4.0.0~alpha1-1","4.0.0~alpha1-2","4.0.0~alpha2-2","4.0.0~alpha2-2ubuntu0.1","4.0.0~alpha2-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.6-1","4.0.6-1build1","4.0.7-1","4.1.1-1","4.1.1-1build1","4.1.1-2","4.1.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-6","4.2.1-1","4.2.1-1build1","4.2.1-1build2","4.2.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.2-3","4.6.0-1ubuntu1","4.6.0-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-2","4.9.1-4","4.9.2-1","4.9.2-1build1","4.9.2-2","4.9.3-1","4.9.3-1build2","4.9.3-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.0-5","5.2.2-1","5.2.2-2","5.2.4-2","5.2.4-2build2"]}],"products":[{"vendor":"powerdns","product":"recursor"}],"references":[{"url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-01.html","tags":["advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/07/1","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30195","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v9gv-mwp4-wx7g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-30195","tags":["advisory"]},{"url":"https://repo.powerdns.com/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30195.json","tags":["advisory"]},{"url":"https://github.com/PowerDNS/pdns","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-30195","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-30195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30195","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/04/07/1","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-30195","title":"A crafted zone can lead to an illegal memory access in the PowerDNS Recursor","description":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.\n\nThe remedy is: upgrade to the patched 5.2.1 version.\n\nWe would like to thank Volodymyr Ilyin for bringing this issue to our attention.","status":"published","published":"2025-04-07T13:24:17.879Z","modified":"2025-04-07T16:03:15.727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-10022","description":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.\n\nThe remedy is: upgrade to the patched 5.2.1 version.\n\nWe would like to thank Volodymyr Ilyin for bringing this issue to our attention.","status":"published","published":"2025-04-07T13:24:17Z","modified":"2025-04-07T16:03:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:41.16494Z"}],"ghsa":[{"id":"GHSA-v9gv-mwp4-wx7g","title":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching...","description":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.\n\nThe remedy is: upgrade to the patched 5.2.1 version.\n\nWe would like to thank Volodymyr Ilyin for bringing this issue to our attention.","status":"published","published":"2025-04-07T15:31:21Z","modified":"2025-04-07T18:31:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:00:50.013262Z"}],"nvd":[{"id":"CVE-2025-30195","description":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.\n\nThe remedy is: upgrade to the patched 5.2.1 version.\n\nWe would like to thank Volodymyr Ilyin for bringing this issue to our attention.","status":"published","published":"2025-04-07T14:15:24.813Z","modified":"2026-06-17T09:08:19.923Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:10:59.48027Z"}],"osv":[{"id":"ALPINE-CVE-2025-30195","description":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.\n\nThe remedy is: upgrade to the patched 5.2.1 version.\n\nWe would like to thank Volodymyr Ilyin for bringing this issue to our attention.","status":"published","published":"2025-04-07T14:15:24.813Z","modified":"2026-11-03T06:33:00.39369262Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2025-30195","title":"A crafted zone can lead to an illegal memory access in the PowerDNS Recursor","description":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.\n\nThe remedy is: upgrade to the patched 5.2.1 version.\n\nWe would like to thank Volodymyr Ilyin for bringing this issue to our attention.","status":"published","published":"2025-04-07T13:24:17.879Z","modified":"2026-10-28T02:30:28.53306953Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-30195","description":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.  The remedy is: upgrade to the patched 5.2.1 version.  We would like to thank Volodymyr Ilyin for bringing this issue to our attention.","status":"published","published":"2025-04-07T14:15:24.813Z","modified":"2026-09-01T20:05:45.51527569Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"UBUNTU-CVE-2025-30195","description":"An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service. The remedy is: upgrade to the patched 5.2.1 version. We would like to thank Volodymyr Ilyin for bringing this issue to our attention.","status":"published","published":"2025-04-07T14:15:00Z","modified":"2026-01-20T18:53:49.523417Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"}]}}