CVE-2025-30195: A crafted zone can lead to an illegal memory access in the PowerDNS Recursor

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-07 · updated 2026-06-17
Weakness: CWE-476

Description

An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service. The remedy is: upgrade to the patched 5.2.1 version. We would like to thank Volodymyr Ilyin for bringing this issue to our attention.

Affected products

PowerDNS Recursor: 5.2.0

References

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-01.html
http://www.openwall.com/lists/oss-security/2025/04/07/1

Get alerted when CVE-2025-30195 or the next vulnerability affects your stack