EUVD-2026-24945
GHSA-q6jm-wh7h-j4g3
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.
AnalysisAI
Remote attackers can corrupt PowerDNS Authoritative Server configuration via specially crafted DNS NOTIFY requests, causing persistent denial of service requiring manual administrator intervention. The attack adds malformed secondary domains to the bind backend, rendering the configuration invalid and preventing the server from restarting. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all PowerDNS Authoritative Server instances exposed to untrusted networks and document current versions. Within 7 days: Implement network-level filtering to restrict DNS NOTIFY requests (port 53 TCP/UDP) to known secondary nameserver IP addresses only; disable NOTIFY reception if secondaries are not required. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today