Powerdns vulnerabilities

CVE-2026-52690 Medium · 5.9 CWE-290 Jun 25, 2026

Spoofed answers can mark an authoritative non-EDNS capable

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.

CVE-2026-42390 Medium · 5.3 CWE-20 Jun 25, 2026

ZONEMD validation can be bypassed

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.

CVE-2026-42389 Medium · 5.3 CWE-20 Jun 25, 2026

Reject more queries with invalid header values

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.

CVE-2026-42388 Medium · 5.9 CWE-20 Jun 25, 2026

Missing input validation for catalog zones

Incomplete validation of the SOA record present in a catalog zone might lead to a crash.

CVE-2026-42387 Medium · 5.9 CWE-20 Jun 25, 2026

Insufficient input validation in ZoneToCache

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.

CVE-2026-40012 Medium · 5.3 CWE-524 Jun 25, 2026

Information about ECS zero scoped answers might leak to clients that use a specific ECS

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;

CVE-2026-42004 Low · 3.7 CWE-115 Jun 25, 2026

EDNS options smuggling

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

CVE-2026-40211 Medium · 5.3 CWE-770 Jun 25, 2026

Denial of service via crafted DoH3 queries

An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.

CVE-2026-40210 Medium · 4.8 CWE-126 Jun 25, 2026

Out-of-bounds read in SetMacAddrAction

An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.

CVE-2026-40209 Medium · 5.3 CWE-772 Jun 25, 2026

Denial of service via IXFR queries

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.

CVE-2026-40208 Low · 3.7 CWE-705 Jun 25, 2026

Denial of service via DoH3 queries

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.

CVE-2026-40011 Low · 3.7 CWE-116 Jun 25, 2026

Prometheus denial of service via crafted DNS queries

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

CVE-2026-33612 High · 7.5 CWE-349 Jun 25, 2026

ZoneToCache can poison the cache

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.

CVE-2026-42005 Medium · 4.3 CWE-400 Jun 25, 2026

Insufficient input validation of internal web server

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVE-2026-42396 Medium · 6.5 CWE-94 May 21, 2026

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail

CVE-2026-42002 High · 7.5 CWE-364 May 21, 2026

Concurrency and locking defects in GSS-TSIG

CVE-2026-42001 High · 7.5 CWE-400 May 21, 2026

Insufficient Validation of Autoprimary SOA Queries

CVE-2026-42000 High · 8.6 CWE-77 May 21, 2026

Insufficient Validation of Names During AXFR

CVE-2026-41999 Medium · 4.8 CWE-284 May 21, 2026

Incorrect Behaviour of Views with TCP PROXY Requests

CVE-2026-33611 Medium · 4.9 CWE-190 Apr 22, 2026

Insufficient validation of HTTPS and SVCB records

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

CVE-2026-33610 High · 7.5 CWE-400 Apr 22, 2026

Possible file descriptor exhaustion in forward-dnsupdate

A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.

CVE-2026-33609 Medium · 6.5 CWE-90 Apr 22, 2026

LDAP DN injection

Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.

CVE-2026-33608 Critical · 9.8 CWE-94 Apr 22, 2026

Incomplete domain name sanitization during

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.

CVE-2026-33602 High · 8.2 CWE-122 Apr 22, 2026

Off-by-one access when processing crafted UDP responses

A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.

CVE-2026-33599 High · 8.1 CWE-125 Apr 22, 2026

Out-of-bounds read in service discovery

A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.