Recursor
CVE-2026-0398
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.3 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to increased resource usage and crafted CNAME chains can lead to cache poisoning in. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
DNS recursive resolver denial-of-service via crafted zones and CNAME chain manipulation allows unauthenticated attackers to exhaust server resources and potentially poison the resolver's cache. The vulnerability affects Recursor instances exposed to untrusted DNS queries, enabling attackers to degrade performance or compromise DNS resolution integrity. No patch is currently available.
Earlier versions of this analysis (1)
Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor. [CVSS 5.3 MEDIUM]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.
Know when Recursor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.
Executive ViewAI
CVE-2026-0398 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Crafted delegations or IP fragments can poison cached delegations in Recursor. [CVSS 8.2 HIGH]
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authori
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth)
Remote, unauthenticated denial of service against PowerDNS Recursor allows a network-reachable attacker to consume or ex
Denial of service in PowerDNS Authoritative, Recursor, and dnsdist via unbounded memory allocation in their internal web
Denial of service in PowerDNS Recursor allows remote unauthenticated attackers to exhaust resolver memory by publishing
Unlimited memory allocation in PowerDNS internal web server allows remote denial of service via crafted web requests. Th
PowerDNS Recursor can be driven into memory exhaustion by a single crafted HTTP request to its built-in internal web ser
A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS
GitHub PoC
Exploit-DB