PowerDNS Recursor

• CVE-2026-52688 High 7.5 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation 0.2%
• CVE-2026-52686 Low 3.7 Wildcard CNAME proof validation bypass 0.2%
• CVE-2026-52684 Low 3.7 Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack 0.2%
• CVE-2026-42389 Medium 5.3 Reject more queries with invalid header values 0.3%
• CVE-2026-52690 Medium 5.9 Spoofed answers can mark an authoritative non-EDNS capable 0.4%
• CVE-2026-42390 Medium 5.3 ZONEMD validation can be bypassed 0.3%
• CVE-2026-42388 Medium 5.9 Missing input validation for catalog zones 0.5%
• CVE-2026-42387 Medium 5.9 Insufficient input validation in ZoneToCache 0.5%
• CVE-2026-40012 Medium 5.3 Information about ECS zero scoped answers might leak to clients that use a specific ECS 0.5%
• CVE-2026-33612 High 7.5 ZoneToCache can poison the cache 0.1%
• CVE-2026-33262 Medium 5.9 Insufficient validation of cookie reply 0.4%
• CVE-2026-33261 Medium 5.9 Null pointer accces in aggressive NSEC(3) cache 0.2%
• CVE-2026-33260 Medium 5.3 Insufficient input validation of internal webserver 0.5%
• CVE-2026-33259 Medium 5.0 Concurrent modification of RPZ data can lead to denial of servce 0.2%
• CVE-2026-33258 Medium 5.3 Crafted zones can cause increased resource usage 0.6%
• CVE-2026-33257 Medium 5.3 Insufficient input validation of internal webserver 0.5%
• CVE-2026-33256 Medium 5.3 Unbounded memory allocation by internal web server 0.6%
• CVE-2026-33601 Medium 4.4 Insufficient validation of zonemd record 0.5%
• CVE-2026-33600 Medium 4.4 Null pointer dereference in RPZ transfer 0.5%
• CVE-2025-59024 Medium 6.5 Crafted delegations or IP fragments can poison cached delegations in Recursor 0.1%
• CVE-2025-59023 High 8.2 Crafted delegations or IP fragments can poison cached delegations in Recursor 0.3%
• CVE-2026-24027 Medium 5.3 Crafted zones can lead to increased incoming network traffic 0.5%
• CVE-2026-0398 Medium 5.3 Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor 0.4%
• CVE-2025-59029 Medium 5.3 Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor 0.4%
• CVE-2025-59030 High 7.5 Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor 0.6%
• CVE-2025-30192 High 7.5 A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts 0.3%
• CVE-2025-30195 High 7.5 A crafted zone can lead to an illegal memory access in the PowerDNS Recursor 0.8%
• CVE-2024-25590 High 7.5 Crafted responses can lead to a denial of service due to cache inefficiencies in the Recursor 0.7%
• CVE-2024-25583 High 7.5 Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured 0.8%
• CVE-2023-26437 Low 3.4 Deterred spoofing attempts can lead to authoritative servers being marked unavailable 0.6%