Vulnerabilidades do Powerdns Recursor

CVE-2026-52690 Média · 5.9 CWE-290 25/06/2026

Spoofed answers can mark an authoritative non-EDNS capable

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.

CVE-2026-42390 Média · 5.3 CWE-20 25/06/2026

ZONEMD validation can be bypassed

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.

CVE-2026-42389 Média · 5.3 CWE-20 25/06/2026

Reject more queries with invalid header values

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.

CVE-2026-42388 Média · 5.9 CWE-20 25/06/2026

Missing input validation for catalog zones

Incomplete validation of the SOA record present in a catalog zone might lead to a crash.

CVE-2026-42387 Média · 5.9 CWE-20 25/06/2026

Insufficient input validation in ZoneToCache

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.

CVE-2026-40012 Média · 5.3 CWE-524 25/06/2026

Information about ECS zero scoped answers might leak to clients that use a specific ECS

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;

CVE-2026-33612 Alta · 7.5 CWE-349 25/06/2026

ZoneToCache can poison the cache

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.

CVE-2026-33601 Média · 4.9 CWE-476 22/04/2026

Insufficient validation of zonemd record

If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

CVE-2026-33600 Média · 4.9 CWE-476 22/04/2026

Null pointer dereference in RPZ transfer

An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

CVE-2026-33262 Média · 5.9 CWE-476 22/04/2026

Insufficient validation of cookie reply

An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default.

CVE-2026-33261 Média · 5.9 CWE-353 22/04/2026

Null pointer accces in aggressive NSEC(3) cache

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

CVE-2026-33260 Alta · 7.5 CWE-770 22/04/2026

Insufficient input validation of internal webserver

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVE-2026-33259 Média · 5.0 CWE-416 22/04/2026

Concurrent modification of RPZ data can lead to denial of servce

Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.

CVE-2026-33258 Alta · 7.5 CWE-770 22/04/2026

Crafted zones can cause increased resource usage

By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.

CVE-2026-33257 Alta · 7.5 CWE-770 22/04/2026

Insufficient input validation of internal webserver

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVE-2026-33256 Alta · 7.5 CWE-770 22/04/2026

Unbounded memory allocation by internal web server

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVE-2026-24027 Média · 5.3 CWE-294 09/02/2026

Crafted zones can lead to increased incoming network traffic

Crafted zones can lead to increased incoming network traffic.

CVE-2026-0398 Média · 5.3 CWE-770 09/02/2026

Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor

Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.

CVE-2025-59024 Média · 6.5 CWE-345 09/02/2026

Crafted delegations or IP fragments can poison cached delegations in Recursor

Crafted delegations or IP fragments can poison cached delegations in Recursor.

CVE-2025-59023 Alta · 8.2 CWE-294 09/02/2026

Crafted delegations or IP fragments can poison cached delegations in Recursor

Crafted delegations or IP fragments can poison cached delegations in Recursor.

CVE-2025-59030 Alta · 7.5 CWE-276 09/12/2025

Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor

An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.

CVE-2025-59029 Média · 5.3 CWE-617 09/12/2025

Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor

An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.