Powerdns vulnerabilities

Products

• Recursor 64
• Authoritative 32
• Dnsdist 31
• Powerdns 9
• Authoritative Server 7
• Pdns 3
• Recursor 3
• Recursor 2

Newest

• powerdns recursor RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation CVE-2026-52688 Fix available 7.5 HighJuly 23, 2026
• powerdns recursor Wildcard CNAME proof validation bypass CVE-2026-52686 Fix available 3.7 LowJuly 23, 2026
• powerdns recursor Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack CVE-2026-52684 3.7 LowJuly 23, 2026
• powerdns recursor Reject more queries with invalid header values CVE-2026-42389 Fix available 5.3 MediumJune 25, 2026
• powerdns recursor Spoofed answers can mark an authoritative non-EDNS capable CVE-2026-52690 Fix available 5.9 MediumJune 25, 2026
• powerdns recursor ZONEMD validation can be bypassed CVE-2026-42390 Fix available 5.3 MediumJune 25, 2026
• powerdns recursor Missing input validation for catalog zones CVE-2026-42388 Fix available 5.9 MediumJune 25, 2026
• powerdns recursor Insufficient input validation in ZoneToCache CVE-2026-42387 Fix available 5.9 MediumJune 25, 2026
• powerdns recursor Information about ECS zero scoped answers might leak to clients that use a specific ECS CVE-2026-40012 Fix available 5.3 MediumJune 25, 2026
• powerdns recursor ZoneToCache can poison the cache CVE-2026-33612 Fix available 7.5 HighJune 25, 2026
• powerdns dnsdist EDNS options smuggling CVE-2026-42004 Fix available 3.7 LowJune 25, 2026
• powerdns dnsdist Denial of service via crafted DoH3 queries CVE-2026-40211 Fix available 5.3 MediumJune 25, 2026
• powerdns dnsdist Out-of-bounds read in SetMacAddrAction CVE-2026-40210 Fix available 4.8 MediumJune 25, 2026
• powerdns dnsdist Denial of service via IXFR queries CVE-2026-40209 Fix available 5.3 MediumJune 25, 2026
• powerdns dnsdist Denial of service via DoH3 queries CVE-2026-40208 Fix available 3.7 LowJune 25, 2026
• powerdns dnsdist Prometheus denial of service via crafted DNS queries CVE-2026-40011 Fix available 3.7 LowJune 25, 2026
• powerdns authoritative Insufficient input validation of internal web server CVE-2026-42005 Fix available 4.3 MediumJune 25, 2026
• powerdns authoritative Incorrect Behaviour of Views with TCP PROXY Requests CVE-2026-41999 Fix available 4.8 MediumMay 21, 2026
• powerdns authoritative Concurrency and locking defects in GSS-TSIG CVE-2026-42002 Fix available 5.9 MediumMay 21, 2026
• powerdns authoritative Insufficient Validation of Autoprimary SOA Queries CVE-2026-42001 Fix available 7.5 HighMay 21, 2026
• powerdns authoritative Insufficient Validation of Names During AXFR CVE-2026-42000 Fix available 6.8 MediumMay 21, 2026
• powerdns authoritative Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail CVE-2026-42396 Fix available 4.9 MediumMay 21, 2026
• powerdns authoritative Insufficient validation of HTTPS and SVCB records CVE-2026-33611 Fix available 6.5 MediumApril 22, 2026
• powerdns authoritative Possible file descriptor exhaustion in forward-dnsupdate CVE-2026-33610 Fix available 5.9 MediumApril 22, 2026
• powerdns authoritative LDAP DN injection CVE-2026-33609 Fix available 5.3 MediumApril 22, 2026
• powerdns authoritative Incomplete domain name sanitization during CVE-2026-33608 Fix available 7.4 HighApril 22, 2026
• powerdns dnsdist Denial of service via crafted DNSCrypt query CVE-2026-33593 Fix available 7.5 HighApril 22, 2026
• powerdns dnsdist Outgoing DoH excessive memory allocation CVE-2026-33594 Fix available 5.3 MediumApril 22, 2026
• powerdns dnsdist DoQ/DoH3 excessive memory allocation CVE-2026-33595 Fix available 5.3 MediumApril 22, 2026
• powerdns dnsdist PRSD detection denial of service CVE-2026-33597 Fix available 3.7 LowApril 22, 2026
• powerdns dnsdist TCP backend stream ID overflow CVE-2026-33596 Fix available 3.1 LowApril 22, 2026
• powerdns dnsdist Out-of-bounds read in cache inspection via Lua CVE-2026-33598 Fix available 4.8 MediumApril 22, 2026
• powerdns dnsdist Out-of-bounds read in service discovery CVE-2026-33599 Fix available 3.1 LowApril 22, 2026
• powerdns dnsdist Off-by-one access when processing crafted UDP responses CVE-2026-33602 Fix available 6.5 MediumApril 22, 2026
• powerdns dnsdist Resource exhaustion via DoQ/DoH3 connections CVE-2026-33254 Fix available 5.3 MediumApril 22, 2026
• powerdns recursor Insufficient validation of cookie reply CVE-2026-33262 Fix available 5.9 MediumApril 22, 2026
• powerdns recursor Null pointer accces in aggressive NSEC(3) cache CVE-2026-33261 Fix available 5.9 MediumApril 22, 2026
• powerdns authoritative, dnsdist, recursor +2 more Insufficient input validation of internal webserver CVE-2026-33260 Fix available 5.3 MediumApril 22, 2026
• powerdns recursor Concurrent modification of RPZ data can lead to denial of servce CVE-2026-33259 Fix available 5.0 MediumApril 22, 2026
• powerdns recursor Crafted zones can cause increased resource usage CVE-2026-33258 Fix available 5.3 MediumApril 22, 2026
• powerdns authoritative, dnsdist, recursor +2 more Insufficient input validation of internal webserver CVE-2026-33257 Fix available 5.3 MediumApril 22, 2026
• powerdns recursor Unbounded memory allocation by internal web server CVE-2026-33256 Fix available 5.3 MediumApril 22, 2026
• powerdns recursor Insufficient validation of zonemd record CVE-2026-33601 Fix available 4.4 MediumApril 22, 2026
• powerdns recursor Null pointer dereference in RPZ transfer CVE-2026-33600 Fix available 4.4 MediumApril 22, 2026
• powerdns dnsdist Use after free when parsing EDNS options in Lua CVE-2026-27854 Fix available 4.8 MediumMarch 31, 2026
• powerdns dnsdist Out-of-bounds write when rewriting large DNS packets CVE-2026-27853 Fix available 5.9 MediumMarch 31, 2026
• powerdns dnsdist Unbounded memory allocation for DoQ and DoH3 CVE-2026-24030 Fix available 5.3 MediumMarch 31, 2026
• powerdns dnsdist DNS over HTTPS ACL bypass CVE-2026-24029 Fix available 6.5 MediumMarch 31, 2026
• powerdns dnsdist Out-of-bounds read when parsing DNS packets via Lua CVE-2026-24028 Fix available 5.3 MediumMarch 31, 2026
• powerdns dnsdist Information disclosure via CORS misconfiguration CVE-2026-0397 Fix available 3.1 LowMarch 31, 2026
• Show olderLoading…