CVE-2024-25583: Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-25 · updated 2026-06-17
Weakness: CWE-20

Description

A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.

Affected products

PowerDNS: 4.8.7, 4.9.4, 5.0.3

References

http://www.openwall.com/lists/oss-security/2024/04/24/1
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-02.html
http://www.openwall.com/lists/oss-security/2024/04/24/1
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-02.html

Get alerted when CVE-2024-25583 or the next vulnerability affects your stack