PowerDNS
PowerDNS is a software project providing a DNS authoritative server, recursor and proxy. It is written in C++ and licensed under the GPL. It runs on most Unix derivatives. PowerDNS features a large number of different backends ranging from simple BIND style zonefiles to relational databases and load balancing/failover algorithms.
Products
7- 56 CVEs
- 39 CVEs
- 33 CVEs
- 29 CVEs
- 25 CVEs
- 22 CVEs
- 12 CVEs
Recent CVEs
116| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-24698 | Cri | 0.64 | 9.8 | 0.03 | Oct 2, 2020 | An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able to cause a double-free, leading to a crash or possibly arbitrary code execution. by sending crafted queries with a… | ||
| CVE-2020-10030 | Hig | 0.59 | 8.8 | 0.24 | May 19, 2020 | An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privileges to change the system's hostname) to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where… | ||
| CVE-2017-7557 | Hig | 0.57 | 8.8 | 0.01 | Aug 22, 2017 | dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. | ||
| CVE-2021-36754 | Hig | 0.54 | 7.5 | 0.65 | Jul 30, 2021 | PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception. | ||
| CVE-2018-16855 | Hig | 0.54 | 7.5 | 0.59 | Dec 3, 2018 | An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. | ||
| CVE-2016-5427 | Hig | 0.54 | 7.5 | 0.63 | Sep 21, 2016 | PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of service (backend CPU consumption) via a crafted DNS query. | ||
| CVE-2025-59023 | Hig | 0.53 | 8.2 | 0.00 | Feb 9, 2026 | Crafted delegations or IP fragments can poison cached delegations in Recursor. | ||
| CVE-2020-24696 | Hig | 0.53 | 8.1 | 0.01 | Oct 2, 2020 | An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG… | ||
| CVE-2019-3806 | Hig | 0.53 | 8.1 | 0.01 | Jan 29, 2019 | An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua. | ||
| CVE-2017-15120 | Hig | 0.53 | 7.5 | 0.52 | Jul 27, 2018 | An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference when parsing a specially crafted answer containing a CNAME of a different class than IN. An unauthenticated remote attacker could cause a… | ||
| CVE-2018-1046 | Hig | 0.51 | 7.8 | 0.01 | Jul 16, 2018 | pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.… | ||
| CVE-2016-5426 | Hig | 0.51 | 7.5 | 0.31 | Sep 21, 2016 | PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname. | ||
| CVE-2023-50387 | Hig | 0.50 | 7.5 | 1.00 | Feb 14, 2024 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with… | ||
| CVE-2026-42001 | Hig | 0.49 | 7.5 | 0.00 | May 21, 2026 | Insufficient Validation of Autoprimary SOA Queries | ||
| CVE-2026-33593 | Hig | 0.49 | 7.5 | 0.00 | Apr 22, 2026 | A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query. | ||
| CVE-2025-59030 | Hig | 0.49 | 7.5 | 0.01 | Dec 9, 2025 | An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP. | ||
| CVE-2025-30192 | Hig | 0.49 | 7.5 | 0.00 | Jul 21, 2025 | An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and… | ||
| CVE-2025-30193 | Hig | 0.49 | 7.5 | 0.01 | May 20, 2025 | In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a crash of DNSdist,… | ||
| CVE-2025-30194 | Hig | 0.49 | 7.5 | 0.02 | Apr 29, 2025 | When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched… | ||
| CVE-2025-30195 | Hig | 0.49 | 7.5 | 0.01 | Apr 7, 2025 | An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service. The remedy is: upgrade to the patched 5.2.1 version. We would… |
- risk 0.64cvss 9.8epss 0.03
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able to cause a double-free, leading to a crash or possibly arbitrary code execution. by sending crafted queries with a…
- risk 0.59cvss 8.8epss 0.24
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privileges to change the system's hostname) to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where…
- risk 0.57cvss 8.8epss 0.01
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
- risk 0.54cvss 7.5epss 0.65
PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.
- risk 0.54cvss 7.5epss 0.59
An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash.
- risk 0.54cvss 7.5epss 0.63
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of service (backend CPU consumption) via a crafted DNS query.
- risk 0.53cvss 8.2epss 0.00
Crafted delegations or IP fragments can poison cached delegations in Recursor.
- risk 0.53cvss 8.1epss 0.01
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG…
- risk 0.53cvss 8.1epss 0.01
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.
- risk 0.53cvss 7.5epss 0.52
An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference when parsing a specially crafted answer containing a CNAME of a different class than IN. An unauthenticated remote attacker could cause a…
- risk 0.51cvss 7.8epss 0.01
pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.…
- risk 0.51cvss 7.5epss 0.31
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.
- risk 0.50cvss 7.5epss 1.00
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with…
- risk 0.49cvss 7.5epss 0.00
Insufficient Validation of Autoprimary SOA Queries
- risk 0.49cvss 7.5epss 0.00
A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.
- risk 0.49cvss 7.5epss 0.01
An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.
- risk 0.49cvss 7.5epss 0.00
An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and…
- risk 0.49cvss 7.5epss 0.01
In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a crash of DNSdist,…
- risk 0.49cvss 7.5epss 0.02
When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched…
- risk 0.49cvss 7.5epss 0.01
An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service. The remedy is: upgrade to the patched 5.2.1 version. We would…