PowerDNS vulnerabilities
We track 25 vulnerabilities in PowerDNS products across 4 products. 25 are rated high or critical, and none are known to be exploited. The most recent was published on April 22, 2026.
Latest PowerDNS vulnerabilities
- 7.5 High severity
Authoritative: Uncontrolled Resource Consumption
A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.
- 9.8 Critical severity
Authoritative: Improper Control of Generation of Code
An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual
- 8.2 High severity
DNSdist: Heap-based Buffer Overflow
A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.
- 8.1 High severity
DNSdist: Out-of-bounds Read
A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.
- 9.1 Critical severity
DNSdist: Out-of-bounds Read
A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.
- 7.5 High severity
DNSdist: Allocation of Resources Without Limits or Throttling
A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.
- 7.5 High severity
DNSdist: Allocation of Resources Without Limits or Throttling
A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.
- 7.5 High severity
DNSdist: Allocation of Resources Without Limits or Throttling
An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.
- 7.5 High severity
Authoritative: Allocation of Resources Without Limits or Throttling
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- 7.5 High severity
Authoritative: Allocation of Resources Without Limits or Throttling
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- 7.5 High severity
Recursor: Allocation of Resources Without Limits or Throttling
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- 7.5 High severity
DNSdist: Use After Free
An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been
- 7.5 High severity
DNSdist: Out-of-bounds Write
An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the ini
- 7.5 High severity
DNSdist: Memory Allocation with Excessive Size Value
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception an
- 8.2 High severity
DNSdist: Buffer Over-read
An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access unr
- 7.5 High severity
Recursor: Insufficient Verification of Data Authenticity
An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled
- 7.5 High severity
DNSdist: Uncontrolled Recursion
In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a cr
- 7.5 High severity
DNSdist: Use After Free
When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service. The remedy is: upgr
- 7.5 High severity
Recursor: NULL Pointer Dereference
An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service. The remedy is: upgrade to the patched 5.2.1 ve
- 7.5 High severity
An attacker can publish a zone containing specific Resource Record Sets.
An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can lead to a denial of service.
- 7.5 High severity
When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are…
When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS o
- 7.5 High severity
A crafted response from an upstream server the recursor has been configured to forward-recurse…
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- 7.5 High severity
Hci Baseboard Management Controller: Uncontrolled Resource Consumption
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC
- 7.5 High severity
Enterprise Linux: Allocation of Resources Without Limits or Throttling
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when ther
- 7.5 High severity
Recursor: Uncontrolled Recursion
A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName minimization is used in QM fallback mode. This is fixed in 4.8.1.