What’s Vulnerable › Products
PowerDNS Recursor vulnerabilities
63 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 27 published in the last 12 months.
Check whether your PowerDNS Recursor version is affected
Latest PowerDNS Recursor vulnerabilities
- CVE-2026-52688 — RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation (CVSS 7.5)
- CVE-2026-52686 — Wildcard CNAME proof validation bypass (CVSS 3.7)
- CVE-2026-52684 — Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack (CVSS 3.7)
- CVE-2026-52690 — Spoofed answers can mark an authoritative non-EDNS capable (CVSS 5.9)
- CVE-2026-42390 — ZONEMD validation can be bypassed (CVSS 5.3)
- CVE-2026-42389 — Reject more queries with invalid header values (CVSS 5.3)
- CVE-2026-42388 — Missing input validation for catalog zones (CVSS 5.9)
- CVE-2026-42387 — Insufficient input validation in ZoneToCache (CVSS 5.9)
- CVE-2026-40012 — Information about ECS zero scoped answers might leak to clients that use a specific ECS (CVSS 5.3)
- CVE-2026-33612 — ZoneToCache can poison the cache (CVSS 7.5)
- CVE-2026-33601 — Insufficient validation of zonemd record (CVSS 4.9)
- CVE-2026-33600 — Null pointer dereference in RPZ transfer (CVSS 4.9)
- CVE-2026-33262 — Insufficient validation of cookie reply (CVSS 5.9)
- CVE-2026-33261 — Null pointer accces in aggressive NSEC(3) cache (CVSS 5.9)
- CVE-2026-33260 — Insufficient input validation of internal webserver (CVSS 7.5)
- CVE-2026-33259 — Concurrent modification of RPZ data can lead to denial of servce (CVSS 5.0)
- CVE-2026-33258 — Crafted zones can cause increased resource usage (CVSS 7.5)
- CVE-2026-33257 — Insufficient input validation of internal webserver (CVSS 7.5)
- CVE-2026-33256 — Unbounded memory allocation by internal web server (CVSS 7.5)
- CVE-2026-24027 — Crafted zones can lead to increased incoming network traffic (CVSS 5.3)
- CVE-2026-0398 — Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor (CVSS 5.3)
- CVE-2025-59024 — Crafted delegations or IP fragments can poison cached delegations in Recursor (CVSS 6.5)
- CVE-2025-59023 — Crafted delegations or IP fragments can poison cached delegations in Recursor (CVSS 8.2)
- CVE-2025-59030 — Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor (CVSS 7.5)
- CVE-2025-59029 — Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor (CVSS 5.3)