EUVD-2026-24727
GHSA-rq6v-8q98-rrj8
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.
AnalysisAI
PowerDNS Recursor versions 5.2.x, 5.3.x, and 5.4.0 are vulnerable to denial of service when processing a zone transition from NSEC to NSEC3 DNSSEC record types, causing internal inconsistency and resolver unavailability. The vulnerability requires network access but elevated attack complexity, affecting recursive DNS resolvers in production environments. Vendor patches are available for all affected branches.
Technical ContextAI
This vulnerability affects the DNSSEC validation logic in PowerDNS Recursor, specifically the handling of zone transitions between NSEC (Next Secure) and NSEC3 (Next Secure version 3) record types used for authenticated denial of existence in DNSSEC. NSEC and NSEC3 are cryptographic proof mechanisms that serve different operational purposes: NSEC provides enumeration-proof via chain-of-command records, while NSEC3 provides hashed proofs to prevent zone enumeration. When a zone changes from one type to the other during resolution, the recursor's internal state management fails to properly reconcile the differing record formats, leading to an internal inconsistency condition. This is a network-accessible DNSSEC parsing issue (CWE category: improper validation or state management in cryptographic protocol handling).
RemediationAI
Apply vendor-released patches immediately: upgrade PowerDNS Recursor 5.2.x systems to 5.2.9 or later, 5.3.x systems to 5.3.6 or later, and 5.4.x systems to 5.4.1 or later. Patches are available from the vendor at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html. During patch deployment, monitor resolver logs for DNSSEC processing errors or elevated query failures, which may indicate exploitation attempts or zone transition conditions. If immediate patching is not feasible, implement network-level controls to restrict recursive queries to trusted clients and monitor for sudden resolver unavailability coinciding with large DNSSEC query volumes; however, these mitigations do not address the root cause and should only be temporary measures pending patch deployment. No workarounds or feature disablement options are documented; patching is the only supported remediation.
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . Rated high severity (CVSS 7.5), this
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. Rated high severity (CVSS 8.8)
PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE
The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records du
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. Rated criti
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Denial of service in PowerDNS Authoritative DNS server (versions 4.9.0-4.9.14 and 5.0.0-5.0.4) arises from insufficient
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
Crafted delegations or IP fragments can poison cached delegations in Recursor. [CVSS 8.2 HIGH]
Same weakness CWE-353 – Missing Support for Integrity Check
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today