EUVD-2026-24733Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.
AnalysisAI
Denial of service in PowerDNS Recursor via null pointer dereference in the zoneToCache function when processing zone data from a malicious authoritative server. Affects Recursor 5.2.0 through 5.4.0 and requires high privileges and non-standard network conditions to exploit, resulting in service availability impact but not data compromise. Patch available from vendor.
Technical ContextAI
PowerDNS Recursor is a DNS recursive resolver that caches zone data using the zoneToCache function. The vulnerability exists in this zone caching mechanism, which processes authoritative zone responses from upstream DNS servers. The root cause is a missing consistency check in the zone data validation logic before dereferencing pointers, allowing a crafted zone response to trigger a null pointer dereference. This affects the DNS resolver's core query resolution pathway when zone caching is in use. The vulnerability requires interaction with a malicious authoritative server, meaning the attacker must control or intercept responses from an upstream DNS authority that the Recursor queries.
RemediationAI
Upgrade to patched versions immediately: Recursor 5.2.9 or later, Recursor 5.3.6 or later, or Recursor 5.4.1 or later. Consult vendor advisory at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html for exact patch availability and release dates. As a compensating control, restrict the Recursor's upstream authoritative server list to trusted, internally-controlled nameservers only, reducing exposure to malicious zone responses. Configure firewall rules to prevent the Recursor from accepting DNS responses from external or untrusted networks. Monitor Recursor process availability and implement alerting for unexpected restarts or service interruptions that may indicate exploitation attempts. Note that these controls mitigate risk but do not eliminate the vulnerability; patching is the primary remediation.
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . Rated high severity (CVSS 7.5), this
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. Rated high severity (CVSS 8.8)
PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE
The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records du
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. Rated criti
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Denial of service in PowerDNS Authoritative DNS server (versions 4.9.0-4.9.14 and 5.0.0-5.0.4) arises from insufficient
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
Crafted delegations or IP fragments can poison cached delegations in Recursor. [CVSS 8.2 HIGH]
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today