What’s Vulnerable › Vulnerabilities

CVE-2022-37428

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-23 · updated 2026-06-17
• Weakness: CWE-459

Description

PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query that leads to an answer with specific properties.

Affected products

• Fedoraproject Fedora: 36
• PowerDNS Recursor: from 4.5.0 before 4.5.10; from 4.6.0 before 4.6.3; from 4.7.0 before 4.7.2 — fixed in 4.5.10, 4.6.3, 4.7.2

How to fix

Upgrade to a fixed version: PowerDNS Recursor 4.5.10, 4.6.3, 4.7.2. Check the vendor advisory for mitigations.

References

• https://docs.powerdns.com/recursor/lua-config/protobuf.html
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXSREJKTT6RNE3GXQENQ4R4HS37UNSPX/
• https://docs.powerdns.com/recursor/lua-config/protobuf.html
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXSREJKTT6RNE3GXQENQ4R4HS37UNSPX/

Get alerted when CVE-2022-37428 or the next vulnerability affects your stack