CVE-2016-2120

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-01 · updated 2026-06-17
Weakness: CWE-190

Description

An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record. The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary.

Affected products

Debian Linux: 8.0
PowerDNS Authoritative: through 3.4.10; from 4.0.0 through 4.0.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2120
https://www.debian.org/security/2017/dsa-3764
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2120
https://www.debian.org/security/2017/dsa-3764

Get alerted when CVE-2016-2120 or the next vulnerability affects your stack