PowerDNS Recursor
CVE-2025-59030
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed recursor over network
-
DeliverySend crafted DNS query/response
-
ExploitTrigger availability flaw
-
ExecutionCrash or exhaust resolver
-
ImpactDeny DNS resolution to clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special preconditions are required - remote unauthenticated DoS against a network-reachable PowerDNS Recursor, with impact limited to availability. The primary LIMITING factor is network exposure: the recursor must be reachable by the attacker (recursors are commonly restricted to internal/trusted client networks via ACLs), which substantially reduces real-world reach for properly segmented deployments. NOTE: the published description provides no technical trigger detail, so the exact crafted-input condition could not be confirmed and should be verified against PowerDNS advisory 2025-08; the CWE-276/privilege-escalation labeling is not reflected in the scored impact. |
| Impact | Signals point to a real but non-urgent availability risk. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5 HIGH) describes a remotely reachable, low-complexity, unauthenticated flaw whose only impact is availability (C:N/I:N/A:H) - i.e. a denial-of-service against the resolver, not data compromise. EPSS is low at 0.12% (30th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so exploitation is no public exploit identified at time of analysis. The combination of a high CVSS but low EPSS and no KEV/POC suggests this is a patch-in-normal-cycle issue rather than an emergency, though DNS resolver outages can have broad blast radius. CONFLICTING DATA: the CWE is CWE-276 (Incorrect Default Permissions) and the tags include 'Privilege Escalation', yet the CVSS vector shows ZERO confidentiality/integrity impact and only availability impact - a permissions/privilege-escalation framing is inconsistent with a pure remote DoS vector. No SSVC decision data (exploitation/automatable/technical impact) was provided. The description contains no technical detail beyond the fixed version, so the precise trigger could not be verified against the vendor advisory - verify with PowerDNS advisory 2025-08. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted DNS traffic to an exposed PowerDNS Recursor instance to trigger the flaw and exhaust or crash the service, denying name resolution to all downstream clients. No public exploit code was identified, and the low EPSS (0.12%) indicates exploitation is not currently widespread. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special conditions are needed if the resolver is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 07, 2026
Remote, unauthenticated denial of service against PowerDNS Recursor allows a network-reachable attacker to consume or exhaust resolver resources (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact C:N/I:N/A:H). Alpine Linux shipped the fix in the pdns-recursor package at 5.3.1-r1, and PowerDNS advisory 2025-08 is the authoritative upstream reference; the published description carries no technical trigger detail, so the exact crafted-input condition should be verified against that advisory rather than inferred. The issue is labeled CWE-276 (incorrect default permissions) and tagged 'Privilege Escalation', but the scored impact is purely availability, and no privilege escalation is reflected in the assessed vector. Exploitation requires the recursor to be reachable by the attacker, which is a substantial limiting factor for deployments that restrict recursion to trusted client subnets via ACLs. EPSS is 0.12% (30th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV listing - this is a real but non-urgent availability risk.
Earlier versions of this analysis (1)
PowerDNS Recursor (pdns-recursor) on Alpine Linux received a security fix packaged as version 5.3.1-r1. The underlying vulnerability nature, attack vector, and impact class are not disclosed in available intelligence - only the Alpine Linux vendor advisory confirms a fix was issued. With an EPSS score of 0.12% (30th percentile), exploitation probability is currently low. No active exploitation or public proof-of-concept has been identified at time of analysis.
RemediationAI
Upgrade the Alpine Linux pdns-recursor package to 5.3.1-r1 or later (apk upgrade pdns-recursor, or apk add pdns-recursor=5.3.1-r1 on pinned systems) - the vendor-released fix is Alpine pdns-recursor 5.3.1-r1, and the authoritative technical details and any corresponding upstream Recursor version should be taken from PowerDNS advisory 2025-08 (https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html). Because the trigger is not described publicly, confirm the upstream recursor build is the one the advisory marks as fixed rather than assuming the Alpine -r1 revision alone is sufficient. Where immediate patching is not possible, the highest-value compensating control is to remove reachability: restrict recursion to trusted clients with allow-from/allow-recursion ACLs, bind the recursor to internal interfaces only, and firewall UDP/TCP 53 so only known client subnets can query it - the trade-off is that any external or roaming client legitimately relying on the resolver will lose service until re-scoped or routed through an allowed relay. Additional hardening with side effects: enable response rate limiting (RRL) to blunt high-volume query floods, at the cost of dropping some legitimate queries under burst load; and lower any per-query resource or timeout limits so a malformed-query condition degrades a single worker rather than the whole process, accepting reduced resolver throughput. Monitor recursor restarts, worker crashes, and query-latency spikes as detection signals, and apply OS-level controls (systemd Restart=, process supervision) so an availability failure recovers automatically. Note that no CISA KEV listing or public exploit code is associated with this CVE, so exploitation is not confirmed active; prioritization can follow normal availability-risk patching cadence rather than emergency response, particularly for deployments whose recursors are already ACL-restricted.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PowerDNS Recursor is a caching, recursive DNS resolver that answers queries on UDP/TCP 53 on behalf of downstream clients, typically positioned behind or alongside authoritative PowerDNS instances; CPE data maps the affected component exclusively to cpe:2.3:a:powerdns:recursor with wildcarded version ranges, confirming that the vulnerability lives in the recursor daemon itself rather than in a library it depends on. The assigned root-cause class is CWE-276, incorrect default permissions - a category normally associated with access-control or privilege boundaries, which is consistent with the 'Privilege Escalation' tag but is not reflected in the scored impact, since C:I:N/A:H describes a pure denial-of-service outcome; the discrepancy means the underlying trigger likely involves a resource, socket, or file whose default permissions can be pushed into an unhealthy state by remote input, and the true mechanism can only be pinned down from PowerDNS advisory 2025-08. The Alpine Linux packaging context indicates the upstream Recursor release was rebuilt and repackaged for Alpine, with the effective fixed artifact being the Alpine pdns-recursor package version 5.3.1-r1; because Alpine's -r1 suffix denotes a package revision, defenders should confirm the corresponding upstream Recursor release identified in the PowerDNS advisory before assuming a given upstream build is patched. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, user interaction, or special preconditions are needed - the only barrier is network reachability of the recursor service, which is why segmentation and recursion ACLs are the dominant real-world control.
Know when Recursor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated resolver reachable over the network with low complexity (AV:N/AC:L/PR:N/UI:N); impact is denial of service only, so C:N/I:N/A:H.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
2DescriptionCVE.org
Alpine Linux: pdns-recursor fixed in 5.3.1-r1
Executive ViewAI
PowerDNS Recursor is affected by a remote, unauthenticated denial-of-service vulnerability (CVE-2025-59030) that could exhaust resolver resources and disrupt DNS resolution for organizations with network-reachable instances. Although no public exploit code has been identified at time of analysis and EPSS is low, the availability-only impact means a successful attack could cause service outages, making it important for leadership to ensure recursors are properly segmented and patched. Affected teams should prioritize patching on Alpine Linux with pdns-recursor 5.3.1-r1 and restrict recursion to trusted subnets to reduce exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Crafted delegations or IP fragments can poison cached delegations in Recursor. [CVSS 8.2 HIGH]
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authori
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth)
PowerDNS Recursor can be driven into memory exhaustion by a single crafted HTTP request to its built-in internal web ser
A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS
In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4
An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. Rated high sever
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. Rated
An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN respo
GitHub PoC
Exploit-DB