Powerdns vulnerabilities
75 CVEs and advisories name Powerdns as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33596TCP backend stream ID overflow
- CVE-2026-33598Out-of-bounds read in cache inspection via Lua
- CVE-2026-33599Out-of-bounds read in service discovery
- CVE-2026-33602Off-by-one access when processing crafted UDP responses
- CVE-2026-33254Resource exhaustion via DoQ/DoH3 connections
- CVE-2026-33262Insufficient validation of cookie reply
- CVE-2026-33261Null pointer accces in aggressive NSEC(3) cache
- CVE-2026-33260Insufficient input validation of internal webserver
- CVE-2026-33259Concurrent modification of RPZ data can lead to denial of servce
- CVE-2026-33258Crafted zones can cause increased resource usage
- CVE-2026-33257Insufficient input validation of internal webserver
- CVE-2026-33256Unbounded memory allocation by internal web server
- CVE-2026-33601Insufficient validation of zonemd record
- CVE-2026-33600Null pointer dereference in RPZ transfer
- CVE-2026-27854Use after free when parsing EDNS options in Lua
- CVE-2026-27853Out-of-bounds write when rewriting large DNS packets
- CVE-2026-24030Unbounded memory allocation for DoQ and DoH3
- CVE-2026-24029DNS over HTTPS ACL bypass
- CVE-2026-24028Out-of-bounds read when parsing DNS packets via Lua
- CVE-2026-0397Information disclosure via CORS misconfiguration
- CVE-2026-0396HTML injection in the web dashboard
- CVE-2025-59024Crafted delegations or IP fragments can poison cached delegations in Recursor
- CVE-2025-59023Crafted delegations or IP fragments can poison cached delegations in Recursor
- CVE-2026-24027Crafted zones can lead to increased incoming network traffic
- CVE-2026-0398Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor
- CVE-2025-59029Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor
- CVE-2025-59030Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
- CVE-2025-30187Denial of service via crafted DoH exchange in PowerDNS DNSdist
- CVE-2025-30192A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts
- CVE-2025-30193Denial of service via crafted TCP exchange