PO
Vendor
PowerDNS
136
CVEs
0
On KEV
0
New 30D
Products
RE9.8
Recursor
PowerDNS
60 CVEs0 on KEV0 new
AU9.8
Authoritative
PowerDNS
32 CVEs0 on KEV0 new
DN9.1
DNSdist
PowerDNS
27 CVEs0 on KEV0 new
AS8.8
Authoritative Server
Powerdns
7 CVEs0 on KEV0 new
PO–
Powerdns
Powerdns
7 CVEs0 on KEV0 new
PR–
Powerdns Recursor
Powerdns
2 CVEs0 on KEV0 new
PD7.8
Pdns
Powerdns
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-52688 | RE Recursor PowerDNS | 7.5 | Jul 23 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation |
| CVE-2026-52686 | RE Recursor PowerDNS | 3.7 | Jul 23 | Wildcard CNAME proof validation bypass |
| CVE-2026-52684 | RE Recursor PowerDNS | 3.7 | Jul 23 | Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack |
| CVE-2026-42389 | RE Recursor PowerDNS | 5.3 | Jun 25 | Reject more queries with invalid header values |
| CVE-2026-52690 | RE Recursor PowerDNS | 5.9 | Jun 25 | Spoofed answers can mark an authoritative non-EDNS capable |
| CVE-2026-42390 | RE Recursor PowerDNS | 5.3 | Jun 25 | ZONEMD validation can be bypassed |
| CVE-2026-42388 | RE Recursor PowerDNS | 5.9 | Jun 25 | Missing input validation for catalog zones |
| CVE-2026-42387 | RE Recursor PowerDNS | 5.9 | Jun 25 | Insufficient input validation in ZoneToCache |
| CVE-2026-40012 | RE Recursor PowerDNS | 5.3 | Jun 25 | Information about ECS zero scoped answers might leak to clients that use a specific ECS |
| CVE-2026-33612 | RE Recursor PowerDNS | 7.5 | Jun 25 | ZoneToCache can poison the cache |
| CVE-2026-42004 | DN DNSdist PowerDNS | 3.7 | Jun 25 | EDNS options smuggling |
| CVE-2026-40211 | DN DNSdist PowerDNS | 5.3 | Jun 25 | Denial of service via crafted DoH3 queries |
| CVE-2026-40210 | DN DNSdist PowerDNS | 4.8 | Jun 25 | Out-of-bounds read in SetMacAddrAction |
| CVE-2026-40209 | DN DNSdist PowerDNS | 5.3 | Jun 25 | Denial of service via IXFR queries |
| CVE-2026-40208 | DN DNSdist PowerDNS | 3.7 | Jun 25 | Denial of service via DoH3 queries |
| CVE-2026-40011 | DN DNSdist PowerDNS | 3.7 | Jun 25 | Prometheus denial of service via crafted DNS queries |
| CVE-2026-42005 | AU Authoritative PowerDNS | 4.3 | Jun 25 | Insufficient input validation of internal web server |
| CVE-2026-41999 | AU Authoritative PowerDNS | 4.8 | May 21 | Incorrect Behaviour of Views with TCP PROXY Requests |
| CVE-2026-42002 | AU Authoritative PowerDNS | 7.5 | May 21 | Concurrency and locking defects in GSS-TSIG |
| CVE-2026-42001 | AU Authoritative PowerDNS | 7.5 | May 21 | Insufficient Validation of Autoprimary SOA Queries |
| CVE-2026-42000 | AU Authoritative PowerDNS | 8.6 | May 21 | Insufficient Validation of Names During AXFR |
| CVE-2026-42396 | AU Authoritative PowerDNS | 6.5 | May 21 | Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail |
| CVE-2026-33611 | AU Authoritative PowerDNS | 4.9 | Apr 22 | Insufficient validation of HTTPS and SVCB records |
| CVE-2026-33610 | AU Authoritative PowerDNS | 7.5 | Apr 22 | Possible file descriptor exhaustion in forward-dnsupdate |
| CVE-2026-33609 | AU Authoritative PowerDNS | 6.5 | Apr 22 | LDAP DN injection |
| CVE-2026-33608 | AU Authoritative PowerDNS | 9.8 | Apr 22 | Incomplete domain name sanitization during |
| CVE-2026-33593 | DN DNSdist PowerDNS | 7.5 | Apr 22 | Denial of service via crafted DNSCrypt query |
| CVE-2026-33594 | DN DNSdist PowerDNS | 7.5 | Apr 22 | Outgoing DoH excessive memory allocation |
| CVE-2026-33595 | DN DNSdist PowerDNS | 7.5 | Apr 22 | DoQ/DoH3 excessive memory allocation |
| CVE-2026-33597 | DN DNSdist PowerDNS | 7.5 | Apr 22 | PRSD detection denial of service |
| CVE-2026-33596 | DN DNSdist PowerDNS | 6.5 | Apr 22 | TCP backend stream ID overflow |
| CVE-2026-33598 | DN DNSdist PowerDNS | 9.1 | Apr 22 | Out-of-bounds read in cache inspection via Lua |
| CVE-2026-33599 | DN DNSdist PowerDNS | 8.1 | Apr 22 | Out-of-bounds read in service discovery |
| CVE-2026-33602 | DN DNSdist PowerDNS | 8.2 | Apr 22 | Off-by-one access when processing crafted UDP responses |
| CVE-2026-33254 | DN DNSdist PowerDNS | 7.5 | Apr 22 | Resource exhaustion via DoQ/DoH3 connections |
| CVE-2026-33262 | RE Recursor PowerDNS | 5.9 | Apr 22 | Insufficient validation of cookie reply |
| CVE-2026-33261 | RE Recursor PowerDNS | 5.9 | Apr 22 | Null pointer accces in aggressive NSEC(3) cache |
| CVE-2026-33260 | RE Recursor PowerDNS | 7.5 | Apr 22 | Insufficient input validation of internal webserver |
| CVE-2026-33259 | RE Recursor PowerDNS | 5.0 | Apr 22 | Concurrent modification of RPZ data can lead to denial of servce |
| CVE-2026-33258 | RE Recursor PowerDNS | 7.5 | Apr 22 | Crafted zones can cause increased resource usage |
| CVE-2026-33257 | RE Recursor PowerDNS | 7.5 | Apr 22 | Insufficient input validation of internal webserver |
| CVE-2026-33256 | RE Recursor PowerDNS | 7.5 | Apr 22 | Unbounded memory allocation by internal web server |
| CVE-2026-33601 | RE Recursor PowerDNS | 4.9 | Apr 22 | Insufficient validation of zonemd record |
| CVE-2026-33600 | RE Recursor PowerDNS | 4.9 | Apr 22 | Null pointer dereference in RPZ transfer |
| CVE-2026-27854 | DN DNSdist PowerDNS | 7.5 | Mar 31 | Use after free when parsing EDNS options in Lua |
| CVE-2026-27853 | DN DNSdist PowerDNS | 7.5 | Mar 31 | Out-of-bounds write when rewriting large DNS packets |
| CVE-2026-24030 | DN DNSdist PowerDNS | 7.5 | Mar 31 | Unbounded memory allocation for DoQ and DoH3 |
| CVE-2026-24029 | DN DNSdist PowerDNS | 6.5 | Mar 31 | DNS over HTTPS ACL bypass |
| CVE-2026-24028 | DN DNSdist PowerDNS | 8.2 | Mar 31 | Out-of-bounds read when parsing DNS packets via Lua |
| CVE-2026-0397 | DN DNSdist PowerDNS | 4.3 | Mar 31 | Information disclosure via CORS misconfiguration |
| CVE-2026-0396 | DN DNSdist PowerDNS | 4.3 | Mar 31 | HTML injection in the web dashboard |
| CVE-2026-24027 | RE Recursor Powerdns | 5.3 | Feb 9 | Crafted zones can lead to increased incoming network traffic |
| CVE-2026-0398 | RE Recursor Powerdns | 5.3 | Feb 9 | Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor |
| CVE-2025-59024 | RE Recursor Powerdns | 6.5 | Feb 9 | Crafted delegations or IP fragments can poison cached delegations in Recursor |
| CVE-2025-59023 | RE Recursor Powerdns | 8.2 | Feb 9 | Crafted delegations or IP fragments can poison cached delegations in Recursor |
| CVE-2025-59030 | RE Recursor Powerdns | 7.5 | Dec 9 | An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP |
| CVE-2025-59029 | RE Recursor Powerdns | 5.3 | Dec 9 | An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY |
| CVE-2023-50868 | RE Recursor Powerdns | 7.5 | Feb 14 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for… |
| CVE-2023-50387 | RE Recursor Powerdns | 7.5 | Feb 14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more… |
| CVE-2023-26437 | RE Recursor Powerdns | 5.3 | Apr 4 | Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through… |