EUVD-2026-24721
GHSA-mfmv-pg93-65w5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.
AnalysisAI
Denial of service in PowerDNS Recursor allows remote unauthenticated attackers to exhaust resolver memory by publishing and querying crafted DNS zones that trigger excessive allocation in the negative and aggressive NSEC(3) caches. The vulnerability affects Recursor versions 5.2.0-5.2.8, 5.3.0-5.3.5, and 5.4.0, with a CVSS score of 5.3 reflecting low severity due to availability impact only (no code execution or data breach). Vendor-released patches are available.
Technical ContextAI
PowerDNS Recursor is a recursive DNS resolver that caches negative (NXDOMAIN, NODATA) and aggressive NSEC(3) denial-of-existence proofs to optimize query performance and reduce upstream traffic. The vulnerability lies in the caching logic for NSEC and NSEC3 records-specifically, the resolver does not properly limit the size or quantity of cache entries created in response to crafted zone queries. An attacker can craft DNS responses or publish malicious zones that cause the resolver to allocate disproportionately large memory structures in these caches, eventually exhausting available heap memory and triggering a denial of service. The root cause involves insufficient bounds checking on cache allocation for negative/aggressive proof records, allowing an unbounded growth attack vector over the DNS protocol (UDP/TCP port 53).
RemediationAI
Upgrade PowerDNS Recursor to version 5.2.9, 5.3.6, 5.4.1, or later as applicable to your deployment. Check the vendor advisory at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html for patch availability and release dates. If immediate patching is not feasible, implement rate limiting on DNS queries per client IP (e.g., using firewall or resolver-level rules) to limit the number of crafted zone queries an attacker can inject, reducing cache pollution impact. Additionally, consider restricting recursive resolution to trusted clients or networks via access control lists (ACLs) in the Recursor configuration; this limits exposure to external attackers but may impact legitimate recursive clients. Monitor resolver memory usage and cache statistics (via PowerDNS API or logs) for abnormal growth in NSEC/NSEC3 cache entries, which would indicate active exploitation attempts. Note that rate limiting may introduce latency for legitimate high-volume DNS consumers, and ACL restrictions reduce resolver utility for open recursive scenarios.
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . Rated high severity (CVSS 7.5), this
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. Rated high severity (CVSS 8.8)
PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE
The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records du
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. Rated criti
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Denial of service in PowerDNS Authoritative DNS server (versions 4.9.0-4.9.14 and 5.0.0-5.0.4) arises from insufficient
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
Crafted delegations or IP fragments can poison cached delegations in Recursor. [CVSS 8.2 HIGH]
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today