Powerdns vulnerabilities
Published CVEs affecting Powerdns products: 57 record(s), with severity, exploitation and fixes.
CVE-2026-0396
Medium · 4.3
CWE-80 Mar 31, 2026
HTML injection in the web dashboard
An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.
CVE-2026-24027
Medium · 5.3
CWE-294 Feb 9, 2026
Crafted zones can lead to increased incoming network traffic
Crafted zones can lead to increased incoming network traffic.
CVE-2026-0398
Medium · 5.3
CWE-770 Feb 9, 2026
Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor
Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.
CVE-2025-59024
Medium · 6.5
CWE-345 Feb 9, 2026
Crafted delegations or IP fragments can poison cached delegations in Recursor
Crafted delegations or IP fragments can poison cached delegations in Recursor.
CVE-2025-59023
High · 8.2
CWE-294 Feb 9, 2026
Crafted delegations or IP fragments can poison cached delegations in Recursor
Crafted delegations or IP fragments can poison cached delegations in Recursor.
CVE-2025-59030
High · 7.5
CWE-276 Dec 9, 2025
Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.
CVE-2025-59029
Medium · 5.3
CWE-617 Dec 9, 2025
Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor
An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.