Read the docs
TI-2019-02881 Aliases CVE-2019-3871GHSA-mg3r-wf83-7hqh

Improper input validation in PowerDNS pdns

Priority MEDIUM 52CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response

Why it matters now

EPSS 0.12632 96th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PowerDNSpdns4.1.7; 4.0.7—No fix listedCNA
  • pdns VendorPowerDNS Affected 4.1.7; 4.0.7 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:powerdns:authoritative_server:*:*:*:*:*:*:*:*before 4.0.7; 4.1.0 to before 4.1.7VulnerablePowerDNS
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*28VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
  • cpe:2.3:a:powerdns:authoritative_server:*:*:*:*:*:*:*:* Versions before 4.0.7; 4.1.0 to before 4.1.7 Vulnerable ·PowerDNS
  • cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3871
  2. 2026-10-03 Alias added: GHSA-mg3r-wf83-7hqh

References

Exploit 2

Advisory 5

Other 2

  • TI-2021-14878 PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by… CVSS 3.1HIGH 7.5
  • TI-2022-10348 In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1… CVSS 3.1HIGH 7.5
  • TI-2016-05296 PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers… CVSS 3.0MEDIUM 6.8
  • TI-2008-03198 PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make… CVSS 2.0MEDIUM 6.4
  • TI-2012-00199 common_startup.cc in PowerDNS (aka pdns) Authoritative Server before 2.9.22.5 and 3.x… CVSS 2.0MEDIUM 5.0
  • TI-2019-07524 Incorrect numeric conversion in Red Hat pdns CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences