RE
Product
Recursor
60
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 22Medium 25Low 3
Watch
Add Recursor to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-3807 | 9.8 | Jan 29 | An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not… Affected: 4.1.0 through 4.1.8 |
| CVE-2020-10030 | 8.8 | May 19 | An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0 Affected: 4.1.0 through 4.3.0 |
| CVE-2025-59023 | 8.2 | Feb 9 | Crafted delegations or IP fragments can poison cached delegations in Recursor Affected: 5.3.0 before 5.3.1; 5.2.0 before 5.2.6; 5.1.0 before 5.1.8 |
| CVE-2019-3806 | 8.1 | Jan 29 | An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination… Affected: 4.1.4 before 4.1.9 |
| CVE-2026-52688 | 7.5 | Jul 23 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation Affected: 5.2.0 before 5.2.12; 5.3.0 before 5.3.9; 5.4.0 before 5.4.4 |
| CVE-2026-33612 | 7.5 | Jun 25 | ZoneToCache can poison the cache Affected: 5.2.0 before 5.2.11; 5.3.0 before 5.3.8; 5.4.0 before 5.4.3 |
| CVE-2026-33260 | 7.5 | Apr 22 | Insufficient input validation of internal webserver Affected: 5.4.0 before 5.4.1; 5.3.0 before 5.3.6; 5.2.0 before 5.2.9 |
| CVE-2026-33258 | 7.5 | Apr 22 | Crafted zones can cause increased resource usage Affected: 5.4.0 before 5.4.1; 5.3.0 before 5.3.6; 5.2.0 before 5.2.9 |
| CVE-2026-33257 | 7.5 | Apr 22 | Insufficient input validation of internal webserver Affected: 5.4.0 before 5.4.1; 5.3.0 before 5.3.6; 5.2.0 before 5.2.9 |
| CVE-2026-33256 | 7.5 | Apr 22 | Unbounded memory allocation by internal web server Affected: 5.4.0 before 5.4.1; 5.3.0 before 5.3.6; 5.2.0 before 5.2.9 |
| CVE-2025-59030 | 7.5 | Dec 9 | An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP Affected: 5.1.0 before 5.1.9; 5.2.0 before 5.2.7; 5.3.0 before 5.3.3 |
| CVE-2023-50868 | 7.5 | Feb 14 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for… Affected: before 4.8.5; 4.9.0 before 4.9.3; 5.0.0 before 5.0.2 |
| CVE-2023-50387 | 7.5 | Feb 14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more… Affected: 4.8.0 before 4.8.6; 4.9.0 before 4.9.3; 5.0.0 before 5.0.2 |
| CVE-2023-22617 | 7.5 | Jan 21 | A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName… Affected: 4.8.0 |
| CVE-2022-27227 | 7.5 | Mar 25 | In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1,… Affected: before 4.4.8; 4.5.0 before 4.5.8; 4.6.0 before 4.6.1 |
| CVE-2020-25829 | 7.5 | Oct 16 | An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5 Affected: before 4.1.18; 4.2.0 before 4.2.5; 4.3.0 before 4.3.5 |
| CVE-2020-10995 | 7.5 | May 19 | PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks Affected: 4.1.0 through 4.3.0 |
| CVE-2020-12244 | 7.5 | May 19 | An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in… Affected: 4.1.0 through 4.3.0 |
| CVE-2018-16855 | 7.5 | Dec 3 | An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of… Affected: before 4.1.8 |
| CVE-2018-14626 | 7.5 | Nov 29 | PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via crafted query that can… Affected: 4.0.0 through 4.1.4 |
| CVE-2018-10851 | 7.5 | Nov 29 | PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while… Affected: 3.2 through 4.1.4 |
| CVE-2016-7068 | 7.5 | Sep 11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU… Affected: before 3.7.4; 4.0.0 before 4.0.4 |
| CVE-2017-15120 | 7.5 | Jul 27 | An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference when parsing a specially crafted answer… Affected: before 4.0.8 |
| CVE-2025-59024 | 6.5 | Feb 9 | Crafted delegations or IP fragments can poison cached delegations in Recursor Affected: 5.3.0 before 5.3.1; 5.2.0 before 5.2.6; 5.1.0 before 5.1.8 |
| CVE-2022-37428 | 6.5 | Aug 23 | PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service… Affected: 4.5.0 before 4.5.10; 4.6.0 before 4.6.3; 4.7.0 before 4.7.2 |
| CVE-2017-15092 | 6.1 | Jan 23 | A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without… Affected: 4.0.0 through 4.0.6 |
| CVE-2026-52690 | 5.9 | Jun 25 | Spoofed answers can mark an authoritative non-EDNS capable Affected: 5.2.0 before 5.2.11; 5.3.0 before 5.3.8; 5.4.0 before 5.4.3 |
| CVE-2026-42388 | 5.9 | Jun 25 | Missing input validation for catalog zones Affected: 5.2.0 before 5.2.11; 5.3.0 before 5.3.8; 5.4.0 before 5.4.3 |
| CVE-2026-42387 | 5.9 | Jun 25 | Insufficient input validation in ZoneToCache Affected: 5.2.0 before 5.2.11; 5.3.0 before 5.3.8; 5.4.0 before 5.4.3 |
| CVE-2026-33262 | 5.9 | Apr 22 | Insufficient validation of cookie reply Affected: 5.4.0 before 5.4.1; 5.3.0 before 5.3.6; 5.2.0 before 5.2.9 |
| CVE-2026-33261 | 5.9 | Apr 22 | Null pointer accces in aggressive NSEC(3) cache Affected: 5.4.0 before 5.4.1; 5.3.0 before 5.3.6; 5.2.0 before 5.2.9 |
| CVE-2018-14644 | 5.9 | Nov 9 | An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4 Affected: 4.0.0 through 4.1.4 |
| CVE-2016-7074 | 5.9 | Sep 11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an… Affected: before 4.0.4 |
| CVE-2016-7073 | 5.9 | Sep 11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an… Affected: before 3.7.4; 4.0.0 before 4.0.4 |
| CVE-2017-15094 | 5.9 | Jan 23 | An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA… Affected: 4.0.0 through 4.0.6 |
| CVE-2017-15090 | 5.9 | Jan 23 | An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid… Affected: 4.0.0 through 4.0.6 |
| CVE-2026-42389 | 5.3 | Jun 25 | Reject more queries with invalid header values Affected: 5.4.0 before 5.4.3 |
| CVE-2026-42390 | 5.3 | Jun 25 | ZONEMD validation can be bypassed Affected: 5.4.0 before 5.4.3 |
| CVE-2026-40012 | 5.3 | Jun 25 | Information about ECS zero scoped answers might leak to clients that use a specific ECS Affected: 5.2.0 before 5.2.11; 5.3.0 before 5.3.8; 5.4.0 before 5.4.3 |
| CVE-2026-24027 | 5.3 | Feb 9 | Crafted zones can lead to increased incoming network traffic Affected: 5.3.0 before 5.3.5; 5.2.0 before 5.2.8; 5.1.0 before 5.1.10 |
| CVE-2026-0398 | 5.3 | Feb 9 | Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor Affected: 5.3.0 before 5.3.5; 5.2.0 before 5.2.8; 5.1.0 before 5.1.10 |
| CVE-2025-59029 | 5.3 | Dec 9 | An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY Affected: 5.3.0; 5.3.1 |
| CVE-2023-26437 | 5.3 | Apr 4 | Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through… Affected: before 4.6.6; 4.7.0 before 4.7.5; 4.8.0 before 4.8.4 |
| CVE-2020-14196 | 5.3 | Jul 1 | In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced Affected: through 4.1.16; 4.2.0 through 4.2.2; 4.3.0 through 4.3.1 |
| CVE-2017-15093 | 5.3 | Jan 23 | When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4… Affected: 3.0 through 3.7.4; 4.0.0 through 4.0.6 |
| CVE-2026-33259 | 5.0 | Apr 22 | Concurrent modification of RPZ data can lead to denial of servce Affected: 5.4.0 before 5.4.1; 5.3.0 before 5.3.6; 5.2.0 before 5.2.9 |
| CVE-2026-33601 | 4.9 | Apr 22 | Insufficient validation of zonemd record Affected: 5.4.0 before 5.4.1; 5.3.0 before 5.3.6; 5.2.0 before 5.2.9 |
| CVE-2026-33600 | 4.9 | Apr 22 | Null pointer dereference in RPZ transfer Affected: 5.4.0 before 5.4.1; 5.3.0 before 5.3.6; 5.2.0 before 5.2.9 |
| CVE-2026-52686 | 3.7 | Jul 23 | Wildcard CNAME proof validation bypass Affected: 5.2.0 before 5.2.12; 5.3.0 before 5.3.9; 5.4.0 before 5.4.4 |
| CVE-2026-52684 | 3.7 | Jul 23 | Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack Affected: 0.0.0 before 5.5.0 |