Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: PowerDNS Recursor 5.2.11, 5.3.8, 5.4.3 Clear all filters
TI-2026-37815 CVE-2026-52690 · GHSA-c2h5-7f6m-jqmp

Spoofed answers can mark an authoritative non-EDNS capable

Priority LOW 27

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00425 Published 2026-06-25 Fixed in 5.2.11, 5.3.8 +1 CWE-290
TI-2026-30688 CVE-2026-42388 · GHSA-wmff-hvrr-9ch3

Missing input validation for catalog zones

Priority LOW 27

Incomplete validation of the SOA record present in a catalog zone might lead to a crash.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00483 Published 2026-06-25 Fixed in 5.2.11, 5.3.8 +1 CWE-20
TI-2026-30687 CVE-2026-42387 · GHSA-9v36-5rhx-cq6m

Insufficient input validation in ZoneToCache

Priority LOW 27

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00483 Published 2026-06-25 Fixed in 5.2.11, 5.3.8 +1 CWE-20
TI-2026-25994 CVE-2026-33612 · GHSA-mc43-3p9f-8c28

ZoneToCache can poison the cache

Priority LOW 32

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00148 Published 2026-06-25 Fixed in 5.2.11, 5.3.8 +1 CWE-349