Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: PowerDNS DNSdist 1.9.15, 2.0.7 Clear all filters
TI-2026-30392 CVE-2026-42004 · GHSA-q4qq-c3qm-82jj

EDNS options smuggling

Priority LOW 17

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS optio…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00225 Published 2026-06-25 Fixed in 1.9.15, 2.0.7 CWE-115
TI-2026-29022 CVE-2026-40211 · GHSA-8mqg-g8g6-fvw6

Denial of service via crafted DoH3 queries

Priority LOW 31

An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.007 Published 2026-06-25 Fixed in 1.9.15, 2.0.7 CWE-770
TI-2026-29021 CVE-2026-40210 · GHSA-5292-qc6p-vf38

Out-of-bounds read in SetMacAddrAction

Priority LOW 23

An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00739 Published 2026-06-25 Fixed in 1.9.15, 2.0.7 CWE-126
TI-2026-29020 CVE-2026-40209 · GHSA-c5m7-ppm5-wp5g

Denial of service via IXFR queries

Priority LOW 31

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.007 Published 2026-06-25 Fixed in 1.9.15, 2.0.7 CWE-772
TI-2026-29019 CVE-2026-40208 · GHSA-2cpw-vgr2-pw3h

Denial of service via DoH3 queries

Priority LOW 18

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00402 Published 2026-06-25 Fixed in 1.9.15, 2.0.7 CWE-705
TI-2026-28854 CVE-2026-40011 · GHSA-f83r-q8f4-f336

Prometheus denial of service via crafted DNS queries

Priority LOW 17

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00225 Published 2026-06-25 Fixed in 1.9.15, 2.0.7 CWE-116