# cve.now: Powerdns

The newest entries naming Powerdns as an affected vendor (up to 200), of 75 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-52688](https://cve.now/CVE-2026-52688.md): RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation (CVSS 7.5)
- [CVE-2026-52686](https://cve.now/CVE-2026-52686.md): Wildcard CNAME proof validation bypass (CVSS 3.7)
- [CVE-2026-52684](https://cve.now/CVE-2026-52684.md): Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack (CVSS 3.7)
- [CVE-2026-42389](https://cve.now/CVE-2026-42389.md): Reject more queries with invalid header values (CVSS 5.3)
- [CVE-2026-52690](https://cve.now/CVE-2026-52690.md): Spoofed answers can mark an authoritative non-EDNS capable (CVSS 5.9)
- [CVE-2026-42390](https://cve.now/CVE-2026-42390.md): ZONEMD validation can be bypassed (CVSS 5.3)
- [CVE-2026-42388](https://cve.now/CVE-2026-42388.md): Missing input validation for catalog zones (CVSS 5.9)
- [CVE-2026-42387](https://cve.now/CVE-2026-42387.md): Insufficient input validation in ZoneToCache (CVSS 5.9)
- [CVE-2026-40012](https://cve.now/CVE-2026-40012.md): Information about ECS zero scoped answers might leak to clients that use a specific ECS (CVSS 5.3)
- [CVE-2026-33612](https://cve.now/CVE-2026-33612.md): ZoneToCache can poison the cache (CVSS 7.5)
- [CVE-2026-42004](https://cve.now/CVE-2026-42004.md): EDNS options smuggling (CVSS 3.7)
- [CVE-2026-40211](https://cve.now/CVE-2026-40211.md): Denial of service via crafted DoH3 queries (CVSS 5.3)
- [CVE-2026-40210](https://cve.now/CVE-2026-40210.md): Out-of-bounds read in SetMacAddrAction (CVSS 4.8)
- [CVE-2026-40209](https://cve.now/CVE-2026-40209.md): Denial of service via IXFR queries (CVSS 5.3)
- [CVE-2026-40208](https://cve.now/CVE-2026-40208.md): Denial of service via DoH3 queries (CVSS 3.7)
- [CVE-2026-40011](https://cve.now/CVE-2026-40011.md): Prometheus denial of service via crafted DNS queries (CVSS 3.7)
- [CVE-2026-42005](https://cve.now/CVE-2026-42005.md): Insufficient input validation of internal web server (CVSS 4.3)
- [CVE-2026-41999](https://cve.now/CVE-2026-41999.md): Incorrect Behaviour of Views with TCP PROXY Requests (CVSS 4.8)
- [CVE-2026-42002](https://cve.now/CVE-2026-42002.md): Concurrency and locking defects in GSS-TSIG (CVSS 5.9)
- [CVE-2026-42001](https://cve.now/CVE-2026-42001.md): Insufficient Validation of Autoprimary SOA Queries (CVSS 7.5)
- [CVE-2026-42000](https://cve.now/CVE-2026-42000.md): Insufficient Validation of Names During AXFR (CVSS 6.8)
- [CVE-2026-42396](https://cve.now/CVE-2026-42396.md): Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail (CVSS 4.9)
- [CVE-2026-33611](https://cve.now/CVE-2026-33611.md): Insufficient validation of HTTPS and SVCB records (CVSS 6.5)
- [CVE-2026-33610](https://cve.now/CVE-2026-33610.md): Possible file descriptor exhaustion in forward-dnsupdate (CVSS 5.9)
- [CVE-2026-33609](https://cve.now/CVE-2026-33609.md): LDAP DN injection (CVSS 5.3)
- [CVE-2026-33608](https://cve.now/CVE-2026-33608.md): Incomplete domain name sanitization during (CVSS 7.4)
- [CVE-2026-33593](https://cve.now/CVE-2026-33593.md): Denial of service via crafted DNSCrypt query (CVSS 7.5)
- [CVE-2026-33594](https://cve.now/CVE-2026-33594.md): Outgoing DoH excessive memory allocation (CVSS 5.3)
- [CVE-2026-33595](https://cve.now/CVE-2026-33595.md): DoQ/DoH3 excessive memory allocation (CVSS 5.3)
- [CVE-2026-33597](https://cve.now/CVE-2026-33597.md): PRSD detection denial of service (CVSS 3.7)
- [CVE-2026-33596](https://cve.now/CVE-2026-33596.md): TCP backend stream ID overflow (CVSS 3.1)
- [CVE-2026-33598](https://cve.now/CVE-2026-33598.md): Out-of-bounds read in cache inspection via Lua (CVSS 4.8)
- [CVE-2026-33599](https://cve.now/CVE-2026-33599.md): Out-of-bounds read in service discovery (CVSS 3.1)
- [CVE-2026-33602](https://cve.now/CVE-2026-33602.md): Off-by-one access when processing crafted UDP responses (CVSS 6.5)
- [CVE-2026-33254](https://cve.now/CVE-2026-33254.md): Resource exhaustion via DoQ/DoH3 connections (CVSS 5.3)
- [CVE-2026-33262](https://cve.now/CVE-2026-33262.md): Insufficient validation of cookie reply (CVSS 5.9)
- [CVE-2026-33261](https://cve.now/CVE-2026-33261.md): Null pointer accces in aggressive NSEC(3) cache (CVSS 5.9)
- [CVE-2026-33260](https://cve.now/CVE-2026-33260.md): Insufficient input validation of internal webserver (CVSS 5.3)
- [CVE-2026-33259](https://cve.now/CVE-2026-33259.md): Concurrent modification of RPZ data can lead to denial of servce (CVSS 5.0)
- [CVE-2026-33258](https://cve.now/CVE-2026-33258.md): Crafted zones can cause increased resource usage (CVSS 5.3)
- [CVE-2026-33257](https://cve.now/CVE-2026-33257.md): Insufficient input validation of internal webserver (CVSS 5.3)
- [CVE-2026-33256](https://cve.now/CVE-2026-33256.md): Unbounded memory allocation by internal web server (CVSS 5.3)
- [CVE-2026-33601](https://cve.now/CVE-2026-33601.md): Insufficient validation of zonemd record (CVSS 4.4)
- [CVE-2026-33600](https://cve.now/CVE-2026-33600.md): Null pointer dereference in RPZ transfer (CVSS 4.4)
- [CVE-2026-27854](https://cve.now/CVE-2026-27854.md): Use after free when parsing EDNS options in Lua (CVSS 4.8)
- [CVE-2026-27853](https://cve.now/CVE-2026-27853.md): Out-of-bounds write when rewriting large DNS packets (CVSS 5.9)
- [CVE-2026-24030](https://cve.now/CVE-2026-24030.md): Unbounded memory allocation for DoQ and DoH3 (CVSS 5.3)
- [CVE-2026-24029](https://cve.now/CVE-2026-24029.md): DNS over HTTPS ACL bypass (CVSS 6.5)
- [CVE-2026-24028](https://cve.now/CVE-2026-24028.md): Out-of-bounds read when parsing DNS packets via Lua (CVSS 5.3)
- [CVE-2026-0397](https://cve.now/CVE-2026-0397.md): Information disclosure via CORS misconfiguration (CVSS 3.1)
- [CVE-2026-0396](https://cve.now/CVE-2026-0396.md): HTML injection in the web dashboard (CVSS 3.1)
- [CVE-2025-59024](https://cve.now/CVE-2025-59024.md): Crafted delegations or IP fragments can poison cached delegations in Recursor (CVSS 6.5)
- [CVE-2025-59023](https://cve.now/CVE-2025-59023.md): Crafted delegations or IP fragments can poison cached delegations in Recursor (CVSS 8.2)
- [CVE-2026-24027](https://cve.now/CVE-2026-24027.md): Crafted zones can lead to increased incoming network traffic (CVSS 5.3)
- [CVE-2026-0398](https://cve.now/CVE-2026-0398.md): Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor (CVSS 5.3)
- [CVE-2025-59029](https://cve.now/CVE-2025-59029.md): Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor (CVSS 5.3)
- [CVE-2025-59030](https://cve.now/CVE-2025-59030.md): Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor (CVSS 7.5)
- [CVE-2025-30187](https://cve.now/CVE-2025-30187.md): Denial of service via crafted DoH exchange in PowerDNS DNSdist (CVSS 3.7)
- [CVE-2025-30192](https://cve.now/CVE-2025-30192.md): A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts (CVSS 7.5)
- [CVE-2025-30193](https://cve.now/CVE-2025-30193.md): Denial of service via crafted TCP exchange (CVSS 7.5)
- [CVE-2025-30194](https://cve.now/CVE-2025-30194.md): Denial of service via crafted DoH exchange (CVSS 7.5)
- [CVE-2025-30195](https://cve.now/CVE-2025-30195.md): A crafted zone can lead to an illegal memory access in the PowerDNS Recursor (CVSS 7.5)
- [CVE-2024-25590](https://cve.now/CVE-2024-25590.md): Crafted responses can lead to a denial of service due to cache inefficiencies in the Recursor (CVSS 7.5)
- [CVE-2024-25581](https://cve.now/CVE-2024-25581.md): Transfer requests received over DoH can lead to a denial of service in DNSdist (CVSS 7.5)
- [CVE-2024-25583](https://cve.now/CVE-2024-25583.md): Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured (CVSS 7.5)
- [CVE-2023-26437](https://cve.now/CVE-2023-26437.md): Deterred spoofing attempts can lead to authoritative servers being marked unavailable (CVSS 3.4)
- [CVE-2015-5230](https://cve.now/CVE-2015-5230.md): The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a den (no CVSS)
- [CVE-2019-10163](https://cve.now/CVE-2019-10163.md): A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to (CVSS 3.5)
- [CVE-2019-10162](https://cve.now/CVE-2019-10162.md): A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the serve (CVSS 3.5)
- [CVE-2017-15120](https://cve.now/CVE-2017-15120.md): An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference whe (CVSS 7.5)
- [CVE-2017-15094](https://cve.now/CVE-2017-15094.md): An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when p (no CVSS)
- [CVE-2017-15093](https://cve.now/CVE-2017-15093.md): When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0. (no CVSS)
- [CVE-2017-15092](https://cve.now/CVE-2017-15092.md): A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname (no CVSS)
- [CVE-2017-15091](https://cve.now/CVE-2017-15091.md): An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, whe (no CVSS)
- [CVE-2017-15090](https://cve.now/CVE-2017-15090.md): An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatur (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/powerdns
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.