Which versions of PowerDNS are affected by CVE-2026-52682?

PowerDNS Authoritative Server, Recursor, and dnsdist are vulnerable to unauthenticated remote denial-of-service attacks through crafted DNS packets that exhaust system resources.

How to fix or mitigate CVE-2026-52682?

Within 24 hours: Identify all PowerDNS deployments (Authoritative Server, Recursor, dnsdist) and determine which are internet-facing or receive queries from untrusted networks; implement immediate query rate-limiting and packet-filtering rules to constrain resource consumption. Within 7 days: Enable detailed logging and alerting for DNS traffic anomalies and abnormal resource utilization; establish an incident response plan and coordinate with infrastructure teams. Within 30 days: Monitor PowerDNS vendor advisories for patch release; develop and test upgrade procedures for all affected components; deploy compensating controls such as DNS firewall rules, traffic filtering on malformed packets, and network segmentation until patches are available.

PowerDNS CVE-2026-52682

CRITICAL

2026-08-06

Denial Of Service

Severity by source

vuln.today AI

7.5 HIGH

Network-accessible DNS port requires no authentication; crafted packet triggers DoS with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 18:16 vuln.today

CVE Published

Aug 06, 2026 - 14:26 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Resource exhaustion via crafted DNS packet affects PowerDNS Authoritative Server, Recursor, and dnsdist, allowing remote unauthenticated attackers to degrade or deny DNS service by sending specially crafted DNS packets that trigger abnormal memory and CPU consumption. The vulnerability spans all three major PowerDNS software components, significantly broadening the attack surface for operators running mixed PowerDNS environments. No public exploit identified at time of analysis, and the flaw is not listed in the CISA KEV catalog, but the low exploitation barrier - any network-reachable DNS query - makes patching urgent for internet-facing DNS infrastructure.

Technical ContextAI

The vulnerability resides in DNS packet parsing logic common to or present across PowerDNS Authoritative Server, PowerDNS Recursor, and dnsdist. The Recursor 5.2.13 changelog reveals two directly relevant fixes: 'Account for the existing content when parsing labels' (PR #17849) and 'Do not index past the address for byte-aligned prefixes' (PR #17852). DNS label parsing is a foundational operation - DNS names are encoded as sequences of length-prefixed labels, and label compression (RFC 1035 §4.1.4) allows pointers that reference earlier parts of the packet. Bugs in this parsing path, such as failure to account for already-consumed bytes or indexing past valid address boundaries for prefix-aligned data, can lead to pathological loops, redundant allocation, or excessive CPU cycles when processing adversarially crafted packets. The CWE is not formally assigned in the input data, but the described behavior is consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-835 (Infinite Loop), rooted in insufficient bounds enforcement during DNS name/label decoding. No CPE strings were provided; affected products are identified by release train from the official advisory.

Affected ProductsAI

PowerDNS Authoritative Server versions prior to 4.9.17, 5.0.7, and 5.1.4 are affected across the 4.9, 5.0, and 5.1 release trains. PowerDNS Recursor versions prior to 5.2.13, 5.3.10, and 5.4.5 are affected across the 5.2, 5.3, and 5.4 release trains. dnsdist versions prior to 1.9.16, 2.0.8, and 2.1.1 are affected across the 1.9, 2.0, and 2.1 release trains. Exact affected version lower bounds per train are not specified in the advisory. No CPE strings were provided. The full security advisory is available at https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-11.html and individual changelogs are linked from the PowerDNS documentation site. Older release trains not listed may be out of support under the updated EOL policy and may also be affected but will not receive patches.

RemediationAI

Upgrade to the fixed releases immediately: PowerDNS Authoritative Server 4.9.17, 5.0.7, or 5.1.4; PowerDNS Recursor 5.2.13, 5.3.10, or 5.4.5; dnsdist 1.9.16, 2.0.8, or 2.1.1. Signed tarballs are available from https://downloads.powerdns.com/releases/ and distribution packages from https://repo.powerdns.com/. Changelogs for the Authoritative Server are at https://docs.powerdns.com/authoritative/changelog/, for Recursor at https://doc.powerdns.com/recursor/changelog/, and for dnsdist at https://www.dnsdist.org/changelog.html. If immediate patching is not feasible, compensating controls include restricting DNS query sources to known and trusted IP ranges via firewall ACLs or dnsdist's built-in ACL functionality - this reduces the population of potential attackers at the cost of breaking open resolver functionality if applicable. Rate-limiting inbound DNS queries per source IP using dnsdist's token-bucket or leaky-bucket rules can limit the throughput of crafted packets and reduce denial-of-service impact, with the trade-off of potentially affecting legitimate high-volume resolvers. Monitoring CPU and memory of PowerDNS processes and alerting on anomalous spikes can provide early warning of exploitation attempts.