Unscored severity · published Nov 2, 2015
CVE-2015-5470
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote…
–
CVSS
11.3%
EPSS
No
On KEV
Description
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.
Exploitation
Is it being used?
Exploit prediction (EPSS)11.3% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Authoritative · Powerdns
through 3.3.2; 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.4.4 · source: NVD
RE
Recursor · Powerdns
through 3.6.3; 3.7.1; 3.7.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5470
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/07/07/6
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/07/10/8
Patch
https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/
More from Authoritative
9.8
CVE-2026-33608
Incomplete domain name sanitization during
9.8
CVE-2020-24698
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used
8.6
CVE-2026-42000
Insufficient Validation of Names During AXFR
8.1
CVE-2020-24696
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used
7.5
CVE-2026-42002
Concurrency and locking defects in GSS-TSIG