--- title: "PowerDNS vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/powerdns type: vendor description: "PowerDNS has 131 published CVEs, 0 in CISA KEV and 4 with public exploits." updated: 2026-07-23 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # PowerDNS vulnerabilities - **Published CVEs:** 131 - **In CISA KEV:** 0 - **With a public exploit:** 4 - **With a patch:** 130 - **Average CVSS:** 6.5 - **CVEs in the last two years:** 62 - **First CVE:** 2005-02-15 - **Latest CVE:** 2026-07-23 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 5 | | High | 62 | | Medium | 56 | | Low | 8 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [pdns](https://radicalnotion.ai/vendor/powerdns/pdns) | 110 | | [Recursor](https://radicalnotion.ai/vendor/powerdns/recursor) | 64 | | [Authoritative](https://radicalnotion.ai/vendor/powerdns/authoritative) | 32 | | [DNSdist](https://radicalnotion.ai/vendor/powerdns/dnsdist) | 31 | | [PowerDNS](https://radicalnotion.ai/vendor/powerdns/powerdns) | 9 | | [authoritative server](https://radicalnotion.ai/vendor/powerdns/authoritative-server) | 7 | | [PowerDNS Recursor](https://radicalnotion.ai/vendor/powerdns/powerdns-recursor) | 5 | | [pdns-recursor](https://radicalnotion.ai/vendor/powerdns/pdns-recursor) | 5 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 20 | | [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 11 | | [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 10 | | [CWE-399](https://radicalnotion.ai/cwe/cwe-399) | Resource Management Errors | 7 | | [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 5 | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 4 | | [CWE-345](https://radicalnotion.ai/cwe/cwe-345) | Insufficient Verification of Data Authenticity | 4 | | [CWE-190](https://radicalnotion.ai/cwe/cwe-190) | Integer Overflow or Wraparound | 3 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [OX](https://radicalnotion.ai/cna/ox) | 66 | | [redhat](https://radicalnotion.ai/cna/redhat) | 32 | | [mitre](https://radicalnotion.ai/cna/mitre) | 30 | | [debian](https://radicalnotion.ai/cna/debian) | 3 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2019 | 6 | | 2020 | 10 | | 2021 | 1 | | 2022 | 2 | | 2023 | 2 | | 2024 | 5 | | 2025 | 7 | | 2026 | 55 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-52688 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation | high | 7.5 | 0.2% | No | 2026-07-23 | | CVE-2026-52686 | Wildcard CNAME proof validation bypass | low | 3.7 | 0.2% | No | 2026-07-23 | | CVE-2026-52684 | Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack | low | 3.7 | 0.2% | No | 2026-07-23 | | CVE-2026-42389 | Reject more queries with invalid header values | medium | 5.3 | 0.3% | No | 2026-06-25 | | CVE-2026-52690 | Spoofed answers can mark an authoritative non-EDNS capable | medium | 5.9 | 0.4% | No | 2026-06-25 | | CVE-2026-42390 | ZONEMD validation can be bypassed | medium | 5.3 | 0.3% | No | 2026-06-25 | | CVE-2026-42388 | Missing input validation for catalog zones | medium | 5.9 | 0.5% | No | 2026-06-25 | | CVE-2026-42387 | Insufficient input validation in ZoneToCache | medium | 5.9 | 0.5% | No | 2026-06-25 | | CVE-2026-40012 | Information about ECS zero scoped answers might leak to clients that use a specific ECS | medium | 5.3 | 0.5% | No | 2026-06-25 | | CVE-2026-33612 | ZoneToCache can poison the cache | high | 7.5 | 0.1% | No | 2026-06-25 | | CVE-2026-42004 | EDNS options smuggling | low | 3.7 | 0.2% | No | 2026-06-25 | | CVE-2026-40211 | Denial of service via crafted DoH3 queries | medium | 5.3 | 0.7% | No | 2026-06-25 | ## Frequently asked questions ### How many CVEs does PowerDNS have? PowerDNS has 131 published CVE records since 2005, including 62 in the last two years. ### How many PowerDNS CVEs are in CISA KEV? None of PowerDNS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Which PowerDNS products have the most CVEs? The PowerDNS products with the most published CVEs are pdns, Recursor, Authoritative, DNSdist, PowerDNS. ### What are the most common weakness types in PowerDNS CVEs? PowerDNS's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption), CWE-399 (Resource Management Errors). ### Are there public exploits for PowerDNS vulnerabilities? Yes — 4 of PowerDNS's CVEs have a known public exploit. ### How many critical PowerDNS vulnerabilities are there? PowerDNS has 5 critical and 62 high-severity CVEs. ### What is the average severity of PowerDNS CVEs? The average CVSS base score across PowerDNS's scored CVEs is 6.5. ## Related vendors - [Automattic](https://radicalnotion.ai/vendor/automattic) (133 CVEs) - [Honeywell](https://radicalnotion.ai/vendor/honeywell) (133 CVEs) - [Puppet](https://radicalnotion.ai/vendor/puppet) (132 CVEs) - [RealMag777](https://radicalnotion.ai/vendor/realmag777) (132 CVEs) - [Grokability](https://radicalnotion.ai/vendor/grokability) (131 CVEs) - [Roundcube](https://radicalnotion.ai/vendor/roundcube) (130 CVEs) - [GE](https://radicalnotion.ai/vendor/ge) (129 CVEs) - [GStreamer](https://radicalnotion.ai/vendor/gstreamer) (129 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/powerdns). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.