31 matches found
CVE-2019-10162
PowerDNS Authoritative Server vulnerability CVE-2019-10162 affects versions prior to 4.1.10 and 4.0.8. An authorized user can cause the server to terminate by inserting a crafted MASTER zone record, triggered when the server parses NS/A/AAAA data for an outgoing NOTIFY. The issue is tied to how p...
CVE-2019-10163
PowerDNS Authoritative Server (v4.0.x before 4.0.8 and v4.1.x before 4.1.9) is affected. A remote, authorized master server can send a flood of NOTIFY messages that causes high CPU load and can prevent updates to slave zones. Only servers configured as slaves are affected. The issue is mitigated ...
CVE-2016-7068
PowerDNS (Authoritative Server and Recursor) pre-fix versions are affected by CVE-2016-7068, allowing remote, unauthenticated attackers to cause abnormal CPU usage by sending crafted DNS queries that trigger parsing of all records in a query, potentially leading to a partial DoS. Affected ranges ...
CVE-2017-15091
The CVE-2017-15091 issue affects PowerDNS Authoritative Server (4.x up to 4.0.4 and 3.x up to 3.4.11). Although the API can be configured as read-only via api-readonly, a missing check permits operations that alter server state: flushing the cache, triggering a zone transfer, or sending NOTIFY wh...
CVE-2020-17482
CVE-2020-17482 affects PowerDNS Authoritative Server prior to 4.3.1. An authorized attacker who can insert crafted records into a zone may leak the content of uninitialized memory. Public details across connected docs confirm the affected product and the memory disclosure issue, with remediation ...
CVE-2018-10851
PowerDNS Authoritative Server (versions 3.3.0–4.1.4, excluding 4.1.5 and 4.0.6) and PowerDNS Recursor (3.2–4.1.4, excluding 4.1.5 and 4.0.9) are affected by CVE-2018-10851 due to a memory leak when parsing malformed records, which can lead to remote denial of service. Multiple connected advisorie...
CVE-2020-24698
CVE-2020-24698 affects PowerDNS Authoritative Server up to version 4.3.0. An attacker can send crafted queries with a GSS-TSIG signature to a remote, unauthenticated endpoint, potentially triggering a double-free that leads to a crash or possibly arbitrary code execution. This is tied to the GSS-...
CVE-2016-2120
CVE-2016-2120 affects PowerDNS Authoritative Server up to and including versions 3.4.10 and 4.0.1. An authorized user can crash the server by inserting a crafted DNS record in a zone they control and querying for that record. Root cause is an integer overflow when checking if the record content m...
CVE-2016-7074
CVE-2016-7074 affects PowerDNS (authoritative server and recursor): insufficient TSIG validation allows MITM to alter AXFR content due to missing check that the TSIG record is last, enabling parsing of records outside the TSIG scope. Affected: PowerDNS versions before 3.4.11/4.0.2 and recursor be...
CVE-2015-1868
CVE-2015-1868 concerns PowerDNS components (Recursor and Authoritative Server) where the vulnerability arises from the label decompression logic. A request whose domain name refers to itself can trigger excessive CPU usage or crash the server, enabling a remote DoS. Affected: PowerDNS Recursor 3....
CVE-2016-7073
PowerDNS (authoritative server and recursor) prior to versions 3.4.11/4.0.2 and 4.0.4 respectively had a vulnerability CVE-2016-7073 where TSIG signatures were insufficiently validated during AXFR, due to a missing check of TSIG time and fudge values in AXFRRetriever. This allowed an attacker in ...
CVE-2018-14626
CVE-2018-14626 affects PowerDNS: Authoritative Server 4.1.0–4.1.4 and Recursor 4.0.0–4.1.4 are vulnerable to packet cache pollution via crafted query, causing denial of service. Exploitation status not detailed in the provided docs. Remediation is to apply the vendor advisories/updates (e.g., Ubu...
CVE-2016-7072
CVE-2016-7072 affects PowerDNS Authoritative Server pre-3.4.11 and 4.0.2, enabling remote, unauthenticated denial of service by opening many TCP connections that can exhaust file descriptors and terminate the process. Multiple connected sources confirm the issue and indicate remediation: upgradin...
CVE-2016-5427
PowerDNS Authoritative Server (pdns) prior to 3.4.10 is vulnerable where a dot inside a DNS label can be mishandled, enabling remote attackers to trigger a denial of service via crafted queries. The issue affects the backend CPU and can lead to partial service disruption; CVSSv3 base score is 7.5...
CVE-2026-33608
CVE-2026-33608 affects the BIND backend of the DNS server as described in multiple sources. An attacker can send a notify request to add a new secondary domain, but the backend then updates its configuration to an invalid state, causing the backend to be unable to run after the next restart and r...
CVE-2020-24697
CVE-2020-24697 affects PowerDNS Authoritative Server up to version 4.3.0 when the flag --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can send crafted GSS-TSIG queries to trigger a denial of service, impacting availability. Several connected sources reiterate a DoS out...
CVE-2015-5470
The CVE-2015-5470 issue affects PowerDNS components: Recursor (before 3.6.4) and 3.7.x before 3.7.3, and Authoritative Server (before 3.3.3 and 3.4.x before 3.4.5). Root cause is the label decompression feature allowing a remote attacker to cause a denial of service by sending a request with a lo...
CVE-2015-5230
CVE-2015-5230 affects PowerDNS Authoritative Server 3.4.x up to before 3.4.6. The DNS packet parsing/generation code can crash the server on crafted query packets, enabling a remote DoS. Upgrading to 3.4.6 or later (per Fedora advisories and vendor fix) is the indicated remediation. No exploitati...
CVE-2016-5426
PowerDNS Authoritative Server (pdns) vulnerable to CVE-2016-5426 and CVE-2016-5427 (and related CVEs) due to handling of qnames longer than 255 bytes and dots inside labels. Versions affected: prior to 3.4.10. Description across sources shows that specially crafted DNS queries can cause abnormal ...
CVE-2020-24696
PowerDNS Authoritative Server (up to 4.3.0) is affected via GSS-TSIG support. A remote, unauthenticated attacker can trigger a race condition by sending crafted queries with a GSS-TSIG signature, potentially causing a crash or arbitrary code execution. Impact is demonstrated as partial confidenti...
CVE-2015-5311
PowerDNS Authoritative Server (pdns) vulnerable to CVE-2015-5311: versions 3.4.4 up to 3.4.6 are affected by a DoS due to an assertion failure in packet handling when processing crafted queries. Multiple connected advisories confirm the issue and cite that upgrading to 3.4.7 mitigates the vulnera...
CVE-2026-33260
CVE-2026-33260 describes an input-validation flaw in the internal web server that can cause unlimited memory allocation when processing a web request, resulting in denial of service. The issue is documented across multiple feeds (NVD, ENISA EUVD, Debian OSV, CIRCL, etc.), all noting that the inte...
CVE-2026-42000
CVE-2026-42000 affects PowerDNS Authoritative server. The issue is "Insufficient Validation of Names During AXFR" in the AXFR process, caused by inadequate validation of transfer names, which is reported to enable a command-injection path per some sources and could contribute to denial of service...
CVE-2026-42001
CVE-2026-42001 affects PowerDNS (pdns). Debian advisory DSA-6284-1 notes multiple vulnerabilities in pdns that could lead to denial of service or information disclosure, including CVE-2026-42001 (insufficient validation of autoprimary SOA queries). The issue is in the PowerDNS DNS server’s handli...
CVE-2026-42002
CVE-2026-42002 relates to PowerDNS Authoritative (pdns) and is caused by concurrency and locking defects in GSS-TSIG. The Debian advisory notes these issues could lead to denial of service or information disclosure, and recommends upgrading to pdns 4.9.15-0+deb13u1. Connected sources also referen...
CVE-2026-42396
Technical details for CVE-2026-42396 are not publicly available in the provided documents. Monitor for updates from Debian advisories and NVD for affected versions and fixes.
CVE-2026-33257
The CVE-2026-33257 issue enables an attacker to send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. In the provided documents, no concrete product/vendor/version, root cause details ...
CVE-2026-33609
CVE-2026-33609 describes incomplete escaping of LDAP queries when 8bit-dns is enabled, enabling LDAP DN injection that could allow queries into internal domain subtrees. The vulnerability is associated with network-level access (no user interaction required) and a base CVSS v3.1 score of 5.3 (MED...
CVE-2026-33610
The CVE describes a denial-of-service risk in PowerDNS: a rogue primary server can exhaust file descriptors when a PowerDNS secondary forwards a DNS update request to it. This is triggered in the forward-dnsupdate path, leading to an eventual DoS on the affected system. Connected advisories (OSV/...
CVE-2026-33611
CVE-2026-33611 affects the Authoritative server when using the LMDB backend. An operator with REST API access can cause the server to produce invalid HTTPS or SVCB record data, which can lead to LMDB database corruption. The underlying issue is insufficient validation of HTTPS/SVCB records via RE...