PowerDNS vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-52688 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validationHigh 7.5 · Jul 23, 2026
• CVE-2026-33612 A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.High 7.5 · Jun 25, 2026
• CVE-2026-42001 Insufficient Validation of Autoprimary SOA QueriesHigh 7.5 · May 21, 2026
• CVE-2026-33608 An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration toHigh 7.4 · Apr 22, 2026
• CVE-2026-33593 A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.High 7.5 · Apr 22, 2026
• CVE-2025-59023 Crafted delegations or IP fragments can poison cached delegations in Recursor.High 8.2 · Feb 9, 2026
• CVE-2025-59030 An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.High 7.5 · Dec 9, 2025
• CVE-2025-30192 An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries.High 7.5 · Jul 21, 2025
• CVE-2025-30193 In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can caHigh 7.5 · May 20, 2025
• CVE-2025-30194 When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegaHigh 7.5 · Apr 29, 2025
• CVE-2025-30195 An attacker can publish a zone containing specific Resource Record Sets.High 7.5 · Apr 7, 2025
• CVE-2024-25590 An attacker can publish a zone containing specific Resource Record Sets.High 7.5 · Oct 3, 2024
• CVE-2024-25581 When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can triggeHigh 7.5 · May 14, 2024
• CVE-2024-25583 A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor.High 7.5 · Apr 25, 2024
• CVE-2023-22617 A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, becHigh 7.5 · Jan 21, 2023
• CVE-2022-27227 In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x befoHigh 7.5 · Mar 25, 2022
• CVE-2021-36754 PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exceHigh 7.5 · Jul 30, 2021
• CVE-2020-25829 An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5.High 7.5 · Oct 16, 2020
• CVE-2020-24698 An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used.Critical 9.8 · Oct 2, 2020
• CVE-2020-24697 An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used.High 7.5 · Oct 2, 2020
• CVE-2020-24696 An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used.High 8.1 · Oct 2, 2020
• CVE-2020-10995 PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks.High 7.5 · May 19, 2020
• CVE-2020-10030 An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0.High 8.8 · May 19, 2020
• CVE-2020-12244 An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly valHigh 7.5 · May 19, 2020
• CVE-2015-5230 The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crasHigh 7.5 · Jan 15, 2020