CVE-2026-52688 | High | 7.5 | 2026-07-23 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation |
CVE-2026-52686 | Low | 3.7 | 2026-07-23 | The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer… |
CVE-2026-52684 | Low | 3.7 | 2026-07-23 | If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resol… |
CVE-2026-52690 | Medium | 5.9 | 2026-06-25 | Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to… |
CVE-2026-42390 | Medium | 5.3 | 2026-06-25 | An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation. |
CVE-2026-42389 | Medium | 5.3 | 2026-06-25 | This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers. |
CVE-2026-42388 | Medium | 5.9 | 2026-06-25 | Incomplete validation of the SOA record present in a catalog zone might lead to a crash. |
CVE-2026-42387 | Medium | 5.9 | 2026-06-25 | A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation. |
CVE-2026-40012 | Medium | 5.3 | 2026-06-25 | ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled; |
CVE-2026-42004 | Low | 3.7 | 2026-06-25 | An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client… |
CVE-2026-40211 | Medium | 5.3 | 2026-06-25 | An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed a… |
CVE-2026-40210 | Medium | 4.8 | 2026-06-25 | An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash. |
CVE-2026-40209 | Medium | 5.3 | 2026-06-25 | An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXF… |
CVE-2026-40208 | Low | 3.7 | 2026-06-25 | An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame. |
CVE-2026-40011 | Low | 3.7 | 2026-06-25 | An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be pro… |
CVE-2026-33612 | High | 7.5 | 2026-06-25 | A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning. |
CVE-2026-42005 | Medium | 4.3 | 2026-06-25 | An attacker can send a web request that causes unlimited memory
allocation in the internal web server, leading to a denial of service.
The internal web serve… |
CVE-2026-42396 | Medium | 4.9 | 2026-05-21 | Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail |
CVE-2026-42002 | Medium | 5.9 | 2026-05-21 | Concurrency and locking defects in GSS-TSIG |
CVE-2026-42001 | High | 7.5 | 2026-05-21 | Insufficient Validation of Autoprimary SOA Queries |
CVE-2026-42000 | Medium | 6.8 | 2026-05-21 | Insufficient Validation of Names During AXFR |
CVE-2026-41999 | Medium | 4.8 | 2026-05-21 | Incorrect Behaviour of Views with TCP PROXY Requests |
CVE-2026-33611 | Medium | 6.5 | 2026-04-22 | An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database… |
CVE-2026-33610 | Medium | 5.9 | 2026-04-22 | A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request… |
CVE-2026-33609 | Medium | 5.3 | 2026-04-22 | Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees. |
CVE-2026-33608 | High | 7.4 | 2026-04-22 | An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration t… |
CVE-2026-33602 | Medium | 6.5 | 2026-04-22 | A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading t… |
CVE-2026-33599 | Low | 3.1 | 2026-04-22 | A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newS… |
CVE-2026-33598 | Medium | 4.8 | 2026-04-22 | A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache. |
CVE-2026-33597 | Low | 3.7 | 2026-04-22 | PRSD detection denial of service |
CVE-2026-33596 | Low | 3.1 | 2026-04-22 | A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed que… |
CVE-2026-33595 | Medium | 5.3 | 2026-04-22 | A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not prop… |
CVE-2026-33594 | Medium | 5.3 | 2026-04-22 | A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate int… |
CVE-2026-33593 | High | 7.5 | 2026-04-22 | A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query. |
CVE-2026-33254 | Medium | 5.3 | 2026-04-22 | An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service… |
CVE-2026-33601 | Medium | 4.4 | 2026-04-22 | If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a m… |
CVE-2026-33600 | Medium | 4.4 | 2026-04-22 | An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of serv… |
CVE-2026-33262 | Medium | 5.9 | 2026-04-22 | An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are d… |
CVE-2026-33261 | Medium | 5.9 | 2026-04-22 | A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service. |
CVE-2026-33260 | Medium | 5.3 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server… |
CVE-2026-33259 | Medium | 5.0 | 2026-04-22 | Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfer… |
CVE-2026-33258 | Medium | 5.3 | 2026-04-22 | By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches. |
CVE-2026-33257 | Medium | 5.3 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server… |
CVE-2026-33256 | Medium | 5.3 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server… |
CVE-2026-27854 | Medium | 4.8 | 2026-03-31 | An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua cod… |
CVE-2026-27853 | Medium | 5.9 | 2026-03-31 | An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:chang… |
CVE-2026-24030 | Medium | 5.3 | 2026-03-31 | An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of… |
CVE-2026-24029 | Medium | 6.5 | 2026-03-31 | When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is… |
CVE-2026-24028 | Medium | 5.3 | 2026-03-31 | An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS… |
CVE-2026-0397 | Low | 3.1 | 2026-03-31 | When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malic… |
CVE-2026-0396 | Low | 3.1 | 2026-03-31 | An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynami… |
CVE-2026-24027 | Medium | 5.3 | 2026-02-09 | Crafted zones can lead to increased incoming network traffic. |
CVE-2026-0398 | Medium | 5.3 | 2026-02-09 | Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor. |
CVE-2025-59024 | Medium | 6.5 | 2026-02-09 | Crafted delegations or IP fragments can poison cached delegations in Recursor. |
CVE-2025-59023 | High | 8.2 | 2026-02-09 | Crafted delegations or IP fragments can poison cached delegations in Recursor. |
CVE-2025-59030 | High | 7.5 | 2025-12-09 | An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP. |
CVE-2025-59029 | Medium | 5.3 | 2025-12-09 | An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with… |
CVE-2025-30187 | Low | 3.7 | 2025-09-18 | In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a d… |
CVE-2025-30192 | High | 7.5 | 2025-07-21 | An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries.
The updated version… |
CVE-2025-30193 | High | 7.5 | 2025-05-20 | In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can c… |
CVE-2025-30194 | High | 7.5 | 2025-04-29 | When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illeg… |
CVE-2025-30195 | High | 7.5 | 2025-04-07 | An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses a… |
CVE-2024-25590 | High | 7.5 | 2024-10-03 | An attacker can publish a zone containing specific Resource Record Sets.
Repeatedly processing and caching results for these sets can lead to a
denial of s… |
CVE-2024-25581 | High | 7.5 | 2024-05-14 | When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigg… |
CVE-2024-25583 | High | 7.5 | 2024-04-25 | A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default co… |
CVE-2023-50868 | High | 7.5 | 2024-02-14 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU… |
CVE-2023-50387 | High | 7.5 | 2024-02-14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumpti… |
CVE-2023-26437 | Low | 3.4 | 2023-04-04 | Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through… |
CVE-2023-22617 | High | 7.5 | 2023-01-21 | A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, be… |
CVE-2022-37428 | Medium | 6.5 | 2022-08-23 | PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a deni… |
CVE-2022-27227 | High | 7.5 | 2022-03-25 | In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x bef… |
CVE-2021-36754 | High | 7.5 | 2021-07-30 | PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exc… |
CVE-2020-25829 | High | 7.5 | 2020-10-16 | An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a gi… |
CVE-2020-24698 | Critical | 9.8 | 2020-10-02 | An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able t… |
CVE-2020-24697 | High | 7.5 | 2020-10-02 | An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can cause a den… |
CVE-2020-24696 | High | 8.1 | 2020-10-02 | An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a r… |
CVE-2020-17482 | Medium | 4.3 | 2020-10-02 | An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be… |
CVE-2020-14196 | Medium | 5.3 | 2020-07-01 | In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced. |
CVE-2020-10995 | High | 7.5 | 2020-05-19 | PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found… |
CVE-2020-10030 | High | 8.8 | 2020-05-19 | An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privileges to change the system's hostname) to… |
CVE-2020-12244 | High | 7.5 | 2020-05-19 | An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly va… |
CVE-2015-5230 | High | 7.5 | 2020-01-15 | The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (cra… |
CVE-2019-10203 | Medium | 4.3 | 2019-11-22 | PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2^32-1 while trying… |
CVE-2019-10163 | Medium | 4.3 | 2019-07-30 | A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU lo… |
CVE-2019-10162 | High | 7.5 | 2019-07-30 | A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by insert… |
CVE-2019-3871 | Medium | 6.5 | 2019-03-21 | A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building… |
CVE-2019-3807 | Low | 3.7 | 2019-01-29 | An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers w… |
CVE-2019-3806 | High | 8.1 | 2019-01-29 | An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some sp… |
CVE-2018-16855 | High | 7.5 | 2018-12-03 | An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while co… |
CVE-2018-14626 | Medium | 5.3 | 2018-11-29 | PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via craf… |
CVE-2018-10851 | Medium | 5.3 | 2018-11-29 | PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a… |
CVE-2018-14663 | Medium | 5.9 | 2018-11-26 | An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record… |
CVE-2018-14644 | Medium | 5.3 | 2018-11-09 | An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type like OPT can lead to a… |
CVE-2016-2120 | High | 7.5 | 2018-11-01 | An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by insertin… |
CVE-2016-7074 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter… |
CVE-2016-7073 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter… |
CVE-2016-7069 | Medium | 5.9 | 2018-09-11 | An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to a… |
CVE-2016-7068 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause… |
CVE-2016-7072 | Medium | 5.3 | 2018-09-10 | An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by op… |
CVE-2017-15120 | High | 7.5 | 2018-07-27 | An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference when parsing a special… |