Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: PowerDNS Authoritative 4.9.14, 5.0.4 Clear all filters
TI-2026-25993 CVE-2026-33611 · GHSA-vqqc-7rwf-3j3j

Insufficient validation of HTTPS and SVCB records

Priority LOW 29

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00423 Published 2026-04-22 Fixed in 5.0.4, 4.9.14 CWE-190
TI-2026-25992 CVE-2026-33610 · GHSA-7rv6-r2fm-295c

Possible file descriptor exhaustion in forward-dnsupdate

Priority LOW 33

A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00393 Published 2026-04-22 Fixed in 5.0.4, 4.9.14 CWE-400
TI-2026-25991 CVE-2026-33609 · GHSA-q8p8-x4x3-fvqm

LDAP DN injection

Priority LOW 28

Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00242 Published 2026-04-22 Fixed in 5.0.4, 4.9.14 CWE-90
TI-2026-25990 CVE-2026-33608 · GHSA-q6jm-wh7h-j4g3

Incomplete domain name sanitization during

Priority MEDIUM 48

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to ru…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00383 Published 2026-04-22 Fixed in 5.0.4, 4.9.14 CWE-94
TI-2026-25677 CVE-2026-33260 · GHSA-r7mf-2mhr-jhvp

Insufficient input validation of internal webserver

Priority LOW 39

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00524 Published 2026-04-22 Fixed in 5.0.4, 4.9.14 +5 CWE-770
TI-2026-25674 CVE-2026-33257 · GHSA-p687-4q66-wh3p

Insufficient input validation of internal webserver

Priority LOW 39

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00514 Published 2026-04-22 Fixed in 5.0.4, 4.9.14 +5 CWE-770