Powerdns Authoritative
32 CVEs affecting Powerdns Authoritative. Latest disclosed: 2026-06-25. Critical: 1, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-24698 | Critical | 9.8 | 2020-10-02 | An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able t… |
CVE-2020-24696 | High | 8.1 | 2020-10-02 | An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a r… |
CVE-2026-42001 | High | 7.5 | 2026-05-21 | Insufficient Validation of Autoprimary SOA Queries |
CVE-2020-24697 | High | 7.5 | 2020-10-02 | An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can cause a den… |
CVE-2015-5230 | High | 7.5 | 2020-01-15 | The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (cra… |
CVE-2019-10162 | High | 7.5 | 2019-07-30 | A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by insert… |
CVE-2016-2120 | High | 7.5 | 2018-11-01 | An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by insertin… |
CVE-2016-5427 | High | 7.5 | 2016-09-21 | PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of ser… |
CVE-2016-5426 | High | 7.5 | 2016-09-21 | PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname. |
CVE-2026-33608 | High | 7.4 | 2026-04-22 | An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration t… |
CVE-2017-15091 | High | 7.1 | 2018-01-23 | An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations… |
CVE-2026-42000 | Medium | 6.8 | 2026-05-21 | Insufficient Validation of Names During AXFR |
CVE-2026-33611 | Medium | 6.5 | 2026-04-22 | An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database… |
CVE-2026-42002 | Medium | 5.9 | 2026-05-21 | Concurrency and locking defects in GSS-TSIG |
CVE-2026-33610 | Medium | 5.9 | 2026-04-22 | A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request… |
CVE-2026-33609 | Medium | 5.3 | 2026-04-22 | Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees. |
CVE-2026-33260 | Medium | 5.3 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server… |
CVE-2026-33257 | Medium | 5.3 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server… |
CVE-2018-14626 | Medium | 5.3 | 2018-11-29 | PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via craf… |
CVE-2018-10851 | Medium | 5.3 | 2018-11-29 | PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a… |