EUVD-2026-31259
GHSA-mxqj-8r4c-fp83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed PowerDNS authoritative nameserver
-
DeliveryConfirm Autoprimary feature enabled
-
ExploitSend crafted SOA query to port 53
-
ExecutionTrigger insufficient validation in Autoprimary handler
-
PersistCause nameserver crash or hang
-
ImpactSustain DoS against authoritative zones
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The PowerDNS Authoritative Server must have the Autoprimary (formerly supermaster) zone-provisioning feature enabled and its DNS listener reachable by the attacker over the network; the attack is delivered as an unauthenticated SOA query to that listener (CVSS PR:N/UI:N). Limiting factors: deployments that do not use Autoprimary are not exposed through this code path, and operators who firewall the authoritative port to known primary IPs substantially narrow the reachable attack surface. No user interaction, no credentials, and no scope change are required (S:U), and only availability is impacted (C:N/I:N/A:H). |
| Impact | Signals are consistent rather than conflicting: CVSS 7.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H matches a classic remote unauthenticated DoS, and the 'Information Disclosure' tag appears mislabeled - the CVSS vector explicitly shows C:N/I:N and only A:H, so this is an availability issue, not data exposure. EPSS data was not provided, the CVE is not on CISA KEV, and no public exploit identified at time of analysis, so this is not yet evidence of in-the-wild abuse. However, authoritative DNS is critical infrastructure: a single crafted packet that can take down a nameserver has outsized blast radius for any operator with Autoprimary enabled and exposed to untrusted networks. Real-world priority is high for PowerDNS Authoritative operators using Autoprimary, and moderate-to-low for those who do not (the feature is typically restricted to known primaries). Note: EPSS unavailable in the provided data - verify before final prioritization. |
| Exploit ScenarioDerived | An attacker who can reach UDP/TCP port 53 on a PowerDNS Authoritative server with Autoprimary enabled sends a crafted SOA query that the Autoprimary handler fails to validate, causing the nameserver process to crash or hang. Repeating the query keeps the resolver offline, breaking DNS resolution for every zone the server is authoritative for and effectively taking the operator's downstream services offline. No public exploit identified at time of analysis, but the CVSS AC:L rating implies a single, reproducible packet is sufficient once the malformed query shape is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 21, 2026
Remote denial of service in PowerDNS Authoritative Server arises from insufficient validation of SOA queries received via the Autoprimary (formerly 'supermaster') replication mechanism, allowing unauthenticated network-based attackers to disrupt service availability. The flaw carries a CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with availability-only impact, and no public exploit identified at time of analysis. The OX-reported issue is documented in PowerDNS Security Advisory 2026-06.
RemediationAI
Patch available per vendor advisory: upgrade PowerDNS Authoritative Server to the fixed release identified in PowerDNS Security Advisory 2026-06 (https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html); exact fix versions are not reproduced in the provided input, so consult the advisory for the precise build. Until you can patch, the most effective compensating control is to disable the Autoprimary feature (set autosecondary=no / remove the legacy supermaster configuration) - the side effect is that new zones can no longer be auto-provisioned and must be configured manually. If Autoprimary must remain enabled, restrict inbound DNS (UDP/TCP 53) at the network edge so that only known primary IPs can reach the authoritative server's query interface, and place the management interface behind an ACL; the trade-off is operational overhead when primaries change addresses. Do not rely on rate limiting alone, as a single malformed SOA may be sufficient to trigger the condition.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PowerDNS Authoritative Server is an open-source authoritative DNS nameserver (CPE cpe:2.3:a:powerdns:authoritative) widely deployed by ISPs, hosting providers, and enterprises. The Autoprimary feature lets the server automatically provision new zones when it receives a NOTIFY/SOA query from a trusted upstream primary, removing the need to manually pre-configure each slave zone. The vulnerability lies in how incoming SOA queries within this Autoprimary code path are validated; insufficient input checks (no CWE was assigned, but the behavior aligns with improper input validation classes such as CWE-20) let a crafted SOA query disrupt the server. Because SOA handling sits in the DNS query path, the flaw is exposed wherever the authoritative service listens for DNS traffic and Autoprimary is enabled.
Know when Powerdns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (OX).
CVSS VectorVendor: OX
Lifecycle Timeline
1DescriptionCVE.org
Insufficient Validation of Autoprimary SOA Queries
Executive ViewAI
PowerDNS Authoritative Server is vulnerable to unauthenticated remote denial-of-service attacks through improper validation of SOA queries in the Autoprimary replication mechanism, directly threatening DNS service availability. Organizations operating PowerDNS as an authoritative nameserver face potential service outages affecting internet-facing applications and internal operations. No vendor patch is currently available, requiring immediate deployment of interim network controls.
Disable Autoprimary replication if not operationally critical. Implement source IP filtering at network perimeter to restrict SOA queries to known secondary nameserver addresses only. Deploy global and per-source rate limiting on DNS query responses to attenuate volumetric attacks. Establish monitoring and alerting for abnormal query patterns, spike detection, and query-source anomalies. Maintain secondary nameserver capacity to provide service continuity if primary becomes unavailable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . Rated high severity (CVSS 7.5), this
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. Rated high severity (CVSS 8.8)
PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE
The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records du
Remote attackers can corrupt PowerDNS Authoritative Server configuration via specially crafted DNS NOTIFY requests, caus
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. Rated criti
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
Out-of-bounds memory read in dnsdist allows remote attackers to trigger information disclosure or denial of service when
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Denial of service in PowerDNS Authoritative DNS server (versions 4.9.0-4.9.14 and 5.0.0-5.0.4) arises from insufficient
Exploit-DB