PowerDNS Recursor CVE-2025-59030

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:42 vuln.today

DescriptionCVE.org

Alpine Linux: pdns-recursor fixed in 5.3.1-r1

AnalysisAI

PowerDNS Recursor (pdns-recursor) on Alpine Linux received a security fix packaged as version 5.3.1-r1. The underlying vulnerability nature, attack vector, and impact class are not disclosed in available intelligence - only the Alpine Linux vendor advisory confirms a fix was issued. With an EPSS score of 0.12% (30th percentile), exploitation probability is currently low. No active exploitation or public proof-of-concept has been identified at time of analysis.

Technical ContextAI

PowerDNS Recursor is a high-performance, open-source recursive DNS resolver widely deployed on Linux systems. Alpine Linux packages it as pdns-recursor, and the fix is specific to the Alpine packaging track (5.3.1-r1 is an Alpine package revision, not necessarily a new upstream PowerDNS version). The vulnerability's root cause class (CWE) is not available in the provided data. No CPE strings were supplied, so the precise affected component within pdns-recursor - whether the DNS parsing logic, query handling, DNSSEC validation, or configuration interface - cannot be determined from available intelligence.

Affected ProductsAI

Alpine Linux deployments running pdns-recursor prior to the patched package version 5.3.1-r1 are affected. The upstream PowerDNS Recursor version corresponding to the vulnerable package is not specified in available data. No CPE strings were provided to further scope affected configurations. Other Linux distributions packaging pdns-recursor independently may also be affected but are not addressed by this Alpine-specific advisory.

RemediationAI

Update the pdns-recursor Alpine Linux package to version 5.3.1-r1 or later using the standard Alpine package manager: 'apk upgrade pdns-recursor'. This is the vendor-confirmed fix per the Alpine Linux advisory. As the vulnerability's nature is undisclosed, specific workarounds cannot be recommended with confidence. If immediate patching is not feasible, restricting network access to the recursive resolver to trusted internal clients only (via firewall rules on port 53 UDP/TCP) reduces exposure surface as a general compensating control, though trade-offs include loss of external resolution capability. Verify the upstream PowerDNS Recursor changelog for any additional guidance.