--- title: "PowerDNS DNSdist vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/powerdns/dnsdist type: product description: "PowerDNS DNSdist has 31 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-06-25 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # PowerDNS DNSdist vulnerabilities Vendor: [PowerDNS](https://radicalnotion.ai/vendor/powerdns) - **Published CVEs:** 31 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 31 - **Average CVSS:** 6.6 - **First CVE:** 2017-08-22 - **Latest CVE:** 2026-06-25 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 1 | | High | 18 | | Medium | 8 | | Low | 4 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 6 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 3 | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 2 | | [CWE-126](https://radicalnotion.ai/cwe/cwe-126) | Buffer Over-read | 2 | | [CWE-116](https://radicalnotion.ai/cwe/cwe-116) | Improper Encoding or Escaping of Output | 2 | | [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 2 | | [CWE-190](https://radicalnotion.ai/cwe/cwe-190) | Integer Overflow or Wraparound | 1 | | [CWE-122](https://radicalnotion.ai/cwe/cwe-122) | Heap-based Buffer Overflow | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2017 | 1 | | 2018 | 2 | | 2019 | 0 | | 2020 | 0 | | 2021 | 0 | | 2022 | 0 | | 2023 | 0 | | 2024 | 1 | | 2025 | 3 | | 2026 | 24 | ## Affected versions (top 27 of 28) | Version | Kind | CVEs | | --- | --- | --- | | 1.9.0 | exact | 1 | | 1.9.1 | exact | 1 | | 1.9.2 | exact | 1 | | 1.9.3 | exact | 1 | | 1.9.0 \<= v \< 1.9.13 | range | 11 | | 2.0.0 \<= v \< 2.0.4 | range | 11 | | 1.9.0 \<= v \< 1.9.12 | range | 7 | | 2.0.0 \<= v \< 2.0.3 | range | 7 | | 1.9.0 \<= v \< 1.9.15 | range | 6 | | 2.0.0 \<= v \< 2.0.7 | range | 6 | | \<= 1.2.0 | range | 1 | | \<= 1.3.2 | range | 1 | | \>= 1.9.10 | range | 1 | | 1.1.0 | range | 1 | | 1.9.0 \<= v \< 1.9.11 | range | 1 | | 1.9.0 \<= v \< 1.9.9 | range | 1 | | 1.9.13 | patched | 11 | | 2.0.4 | patched | 11 | | 1.9.12 | patched | 7 | | 2.0.3 | patched | 7 | | 1.9.15 | patched | 6 | | 2.0.7 | patched | 6 | | 1.9.10 | patched | 1 | | 1.9.11 | patched | 1 | | 1.9.9 | patched | 1 | | 2.0.1 | patched | 1 | | No version pinned | default | 1 | ## CVEs (first 30 of 31, most severe first) | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-42004 | EDNS options smuggling | low | 3.7 | No | No | Yes | | CVE-2026-40211 | Denial of service via crafted DoH3 queries | medium | 5.3 | No | No | Yes | | CVE-2026-40210 | Out-of-bounds read in SetMacAddrAction | medium | 4.8 | No | No | Yes | | CVE-2026-40209 | Denial of service via IXFR queries | medium | 5.3 | No | No | Yes | | CVE-2026-40208 | Denial of service via DoH3 queries | low | 3.7 | No | No | Yes | | CVE-2026-40011 | Prometheus denial of service via crafted DNS queries | low | 3.7 | No | No | Yes | | CVE-2026-33593 | Denial of service via crafted DNSCrypt query | high | 7.5 | No | No | Yes | | CVE-2026-33594 | Outgoing DoH excessive memory allocation | high | 7.5 | No | No | Yes | | CVE-2026-33595 | DoQ/DoH3 excessive memory allocation | high | 7.5 | No | No | Yes | | CVE-2026-33597 | PRSD detection denial of service | high | 7.5 | No | No | Yes | | CVE-2026-33596 | TCP backend stream ID overflow | medium | 6.5 | No | No | Yes | | CVE-2026-33598 | Out-of-bounds read in cache inspection via Lua | critical | 9.1 | No | No | Yes | | CVE-2026-33599 | Out-of-bounds read in service discovery | high | 8.1 | No | No | Yes | | CVE-2026-33602 | Off-by-one access when processing crafted UDP responses | high | 8.2 | No | No | Yes | | CVE-2026-33254 | Resource exhaustion via DoQ/DoH3 connections | high | 7.5 | No | No | Yes | | CVE-2026-33260 | Insufficient input validation of internal webserver | high | 7.5 | No | No | Yes | | CVE-2026-33257 | Insufficient input validation of internal webserver | high | 7.5 | No | No | Yes | | CVE-2026-27854 | Use after free when parsing EDNS options in Lua | high | 7.5 | No | No | Yes | | CVE-2026-27853 | Out-of-bounds write when rewriting large DNS packets | high | 7.5 | No | No | Yes | | CVE-2026-24030 | Unbounded memory allocation for DoQ and DoH3 | high | 7.5 | No | No | Yes | | CVE-2026-24029 | DNS over HTTPS ACL bypass | medium | 6.5 | No | No | Yes | | CVE-2026-24028 | Out-of-bounds read when parsing DNS packets via Lua | high | 8.2 | No | No | Yes | | CVE-2026-0397 | Information disclosure via CORS misconfiguration | medium | 4.3 | No | No | Yes | | CVE-2026-0396 | HTML injection in the web dashboard | medium | 4.3 | No | No | Yes | | CVE-2025-30187 | Denial of service via crafted DoH exchange in PowerDNS DNSdist | low | 3.7 | No | No | Yes | | CVE-2025-30193 | Denial of service via crafted TCP exchange | high | 7.5 | No | No | Yes | | CVE-2025-30194 | Denial of service via crafted DoH exchange | high | 7.5 | No | No | Yes | | CVE-2024-25581 | Transfer requests received over DoH can lead to a denial of service in DNSdist | high | 7.5 | No | No | Yes | | CVE-2018-14663 | - | medium | 5.9 | No | No | Yes | | CVE-2016-7069 | - | high | 7.5 | No | No | Yes | ## Frequently asked questions ### How many CVEs does PowerDNS DNSdist have? PowerDNS DNSdist has 31 published CVE records since 2017. ### How many PowerDNS DNSdist CVEs are in CISA KEV? None of PowerDNS DNSdist's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for PowerDNS DNSdist vulnerabilities? No PowerDNS DNSdist CVEs currently have a tracked public exploit in this dataset. ### Which versions of PowerDNS DNSdist are affected? 28 distinct PowerDNS DNSdist versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in PowerDNS DNSdist CVEs? PowerDNS DNSdist's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-20 (Improper Input Validation), CWE-125 (Out-of-bounds Read), CWE-126 (Buffer Over-read). ### How many critical PowerDNS DNSdist vulnerabilities are there? PowerDNS DNSdist has 1 critical and 18 high-severity CVEs. ### What is the average severity of PowerDNS DNSdist CVEs? The average CVSS base score across PowerDNS DNSdist's scored CVEs is 6.6. ## Other products from this vendor - [pdns](https://radicalnotion.ai/vendor/powerdns/pdns) (110 CVEs) - [Recursor](https://radicalnotion.ai/vendor/powerdns/recursor) (64 CVEs) - [Authoritative](https://radicalnotion.ai/vendor/powerdns/authoritative) (32 CVEs) - [PowerDNS](https://radicalnotion.ai/vendor/powerdns/powerdns) (9 CVEs) - [authoritative server](https://radicalnotion.ai/vendor/powerdns/authoritative-server) (7 CVEs) - [pdns-recursor](https://radicalnotion.ai/vendor/powerdns/pdns-recursor) (5 CVEs) - [PowerDNS Recursor](https://radicalnotion.ai/vendor/powerdns/powerdns-recursor) (5 CVEs) - [PowerDNS Authoritative](https://radicalnotion.ai/vendor/powerdns/powerdns-authoritative) (1 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/powerdns/dnsdist). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.