EUVD-2026-31261
GHSA-cmjg-f724-5qh3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl or compromise upstream primary
-
DeliveryCraft zone with invalid names
-
ExploitSecondary initiates AXFR transfer
-
ExecutionInsufficient name validation triggered
-
ImpactDNS service availability disrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target PowerDNS Authoritative server to be operating as a secondary and to perform an AXFR zone transfer from an attacker-controlled or compromised primary, then process attacker-supplied names that are insufficiently validated. The key limiting factor is that the server must accept AXFR from a source the attacker influences - deployments that restrict AXFR to trusted, TSIG-authenticated primaries are not exposed to arbitrary hostile zone data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction on the AXFR path itself, but the practical prerequisite of a malicious primary substantially constrains real-world reach, consistent with SSVC Exploitation 'none' and EPSS 0.00%. |
| Impact | The signals conflict and warrant caution. The CVSS 3.1 score of 8.6 is driven by network vector (AV:N), low complexity (AC:L), no privileges/UI, a scope change (S:C), and high availability impact - a strong on-paper number. However, EPSS is 0.00% (0th percentile), CISA SSVC rates Exploitation as 'none' and Automatable as 'no', and Technical Impact is only 'partial', all pointing to low real-world urgency and no observed exploitation. No public exploit is identified. Notably, the CWE-77 'Command Injection' label conflicts with the CVSS impact metrics, which show no confidentiality or integrity impact (C:N/I:N) - verify with the PowerDNS advisory whether this is genuine command injection or an availability/validation issue mapped to an imprecise CWE. Practically, exploitation requires the server to accept AXFR from a hostile or compromised primary, which narrows the attack surface in properly configured secondaries. This is a patch-promptly-but-not-emergency issue for most operators, with priority raised for those running secondaries that transfer zones from less-trusted primaries. |
| Exploit ScenarioDerived | An attacker who controls or compromises a primary DNS server (or can otherwise inject AXFR responses to a secondary) crafts a zone transfer containing records with malformed or insufficiently validated names. When a vulnerable PowerDNS Authoritative secondary pulls the zone via AXFR, processing the crafted names disrupts availability (scope-changed A:H). No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 23, 2026
Denial of service in PowerDNS Authoritative DNS server (versions 4.9.0-4.9.14 and 5.0.0-5.0.4) arises from insufficient validation of names processed during AXFR zone transfers, letting a malicious or compromised primary send crafted zone data that disrupts availability. The CVSS 3.1 base score is 8.6 with a scope change (S:C) and availability-only impact (A:H), and no public exploit has been identified at time of analysis. EPSS is 0.00% and CISA SSVC rates exploitation as 'none', indicating no observed real-world attacks despite the high score.
Earlier versions of this analysis (2)
Denial of service in PowerDNS Authoritative server (4.9.0-4.9.14 and 5.0.0-5.0.4) arises from insufficient validation of DNS names processed during an AXFR (zone transfer), classified as CWE-77 command injection but with real-world impact limited to availability. A remote attacker able to supply crafted zone data during transfer can disrupt the authoritative service. EPSS is 0.00% and CISA SSVC records no observed exploitation, so no public exploit identified at time of analysis.
Integrity compromise in PowerDNS Authoritative Server allows network-positioned attackers to inject unauthorized DNS records by exploiting insufficient validation of DNS names received during AXFR (zone transfer) processing. The CVSS changed-scope indicator (S:C) reflects that the high-integrity impact extends beyond the vulnerable server itself to all downstream systems consuming the corrupted zone data, enabling a form of DNS record poisoning. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) constrains exploitation to adversaries with specific network positioning or control over a zone transfer source.
RemediationAI
Upgrade to a fixed release: PowerDNS Authoritative 4.9.15 for the 4.9.x branch or 5.0.5 for the 5.0.x branch (Vendor-released patch: 4.9.15 / 5.0.5), per the vendor advisory at https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html. Because exploitation is through the AXFR ingestion path on secondaries, the most effective compensating control until patching is to restrict AXFR to explicitly trusted primaries - use allow-axfr-ips and TSIG-authenticated transfers so secondaries only pull zones from primaries you fully control, which removes exposure to arbitrary hostile zone data at the cost of tighter transfer configuration. Additionally, firewall inbound AXFR so untrusted networks cannot reach the transfer path, accepting that this does not help if the primary itself is compromised. Do not rely on these controls as a permanent substitute for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PowerDNS Authoritative is a widely used open-source authoritative DNS server that can act as a secondary (slave), pulling zone data from a primary via AXFR - a full zone transfer defined in RFC 5936. The flaw is in how the server validates domain names contained in records received during an AXFR. Although the advisory carries CWE-77 (Command Injection) and a 'Command Injection' tag, the published CVSS vector reflects availability-only impact (C:N/I:N/A:H) with a scope change, which is more consistent with a name-parsing/validation fault causing a crash or service disruption than with true OS command execution. The affected component is confirmed via CPE cpe:2.3:a:powerdns:authoritative and pertains specifically to the AXFR ingestion path used by secondary servers.
Know when Powerdns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Reached over the network via AXFR with no auth or UI on the vulnerable path; availability-only impact with a scope change to the DNS service, matching the vendor vector.
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Insufficient Validation of Names During AXFR
Executive ViewAI
PowerDNS Authoritative DNS server versions 4.9.0-4.9.14 and 5.0.0-5.0.4 are vulnerable to denial-of-service attacks through malicious zone transfer data that could disrupt DNS service availability. Given the high severity and potential for widespread impact on dependent applications and user access, this vulnerability poses a significant business continuity risk. Although no active attacks have been observed, all affected systems require immediate patching to prevent potential outages.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . Rated high severity (CVSS 7.5), this
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. Rated high severity (CVSS 8.8)
PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE
The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records du
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. Rated criti
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
Crafted delegations or IP fragments can poison cached delegations in Recursor. [CVSS 8.2 HIGH]
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. Rated high
Exploit-DB