PowerDNS Recursor vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20242
3. 20254
4. 202623

Newest CVEs

• CVE-2026-52688

  RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

  PowerDNS · Recursor

  High7.5
• CVE-2026-52686

  Wildcard CNAME proof validation bypass

  PowerDNS · Recursor

  Low3.7
• CVE-2026-52684

  Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack

  PowerDNS · Recursor

  Low3.7
• CVE-2026-42389

  Reject more queries with invalid header values

  PowerDNS · Recursor

  Medium5.3
• CVE-2026-52690

  Spoofed answers can mark an authoritative non-EDNS capable

  PowerDNS · Recursor

  Medium5.9
• CVE-2026-42390

  ZONEMD validation can be bypassed

  PowerDNS · Recursor

  Medium5.3
• CVE-2026-42388

  Missing input validation for catalog zones

  PowerDNS · Recursor

  Medium5.9
• CVE-2026-42387

  Insufficient input validation in ZoneToCache

  PowerDNS · Recursor

  Medium5.9
• CVE-2026-40012

  Information about ECS zero scoped answers might leak to clients that use a specific ECS

  PowerDNS · Recursor

  Medium5.3
• CVE-2026-33612

  ZoneToCache can poison the cache

  PowerDNS · Recursor

  High7.5