EUVD-2026-24949
GHSA-7rv6-r2fm-295c
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.
AnalysisAI
Denial of service in PowerDNS secondary servers occurs when a rogue primary server sends crafted DNS update requests that cause file descriptor exhaustion on the secondary, eventually rendering the secondary unable to process legitimate DNS queries. The attack requires network-level coordination between a compromised or attacker-controlled primary server and a target secondary server, with moderate attack complexity due to the need to establish a primary-secondary relationship. No active exploitation has been confirmed in CISA KEV at time of analysis.
Technical ContextAI
PowerDNS Authoritative runs DNS secondary servers that replicate zone data from primary servers via zone transfers and DNS update mechanisms (NOTIFY/AXFR). When a secondary processes a DNS update request (typically via NOTIFY protocol or DNS UPDATE messages), it may allocate file descriptors to handle the incoming data. A rogue primary can send malformed or excessive update requests that fail to properly release file descriptors, leading to resource exhaustion. This is a resource-starvation attack that exploits the secondary's trust relationship with its configured primary server, targeting the DNS update ingestion code path.
RemediationAI
Consult the PowerDNS advisory at https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html for the patched version and apply the vendor-released fix immediately to all secondary servers. In the interim, limit zone transfer relationships and DNS update sources to primary servers on trusted networks; restrict secondary servers' network access to primary servers to only necessary IP addresses and ports using firewall rules; monitor file descriptor usage on secondary servers using system tools (lsof, netstat) to detect exhaustion patterns; and implement rate limiting on NOTIFY/UPDATE message processing at the network perimeter if the DNS infrastructure allows. These compensating controls reduce attack surface but do not eliminate the vulnerability - patching is the authoritative remediation.
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . Rated high severity (CVSS 7.5), this
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. Rated high severity (CVSS 8.8)
PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE
The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records du
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. Rated criti
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Denial of service in PowerDNS Authoritative DNS server (versions 4.9.0-4.9.14 and 5.0.0-5.0.4) arises from insufficient
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
Crafted delegations or IP fragments can poison cached delegations in Recursor. [CVSS 8.2 HIGH]
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today