--- title: "PowerDNS pdns vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/powerdns/pdns type: product description: "PowerDNS pdns has 110 published CVEs, 0 in CISA KEV and 2 with public exploits." updated: 2026-07-23 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # PowerDNS pdns vulnerabilities Vendor: [PowerDNS](https://radicalnotion.ai/vendor/powerdns) - **Published CVEs:** 110 - **In CISA KEV:** 0 - **With a public exploit:** 2 - **With a patch:** 110 - **Average CVSS:** 6.7 - **First CVE:** 2016-09-21 - **Latest CVE:** 2026-07-23 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 4 | | High | 57 | | Medium | 42 | | Low | 7 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 17 | | [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 11 | | [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 10 | | [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 5 | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 4 | | [CWE-345](https://radicalnotion.ai/cwe/cwe-345) | Insufficient Verification of Data Authenticity | 4 | | [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 3 | | [CWE-190](https://radicalnotion.ai/cwe/cwe-190) | Integer Overflow or Wraparound | 3 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2016 | 3 | | 2017 | 1 | | 2018 | 19 | | 2019 | 6 | | 2020 | 9 | | 2021 | 1 | | 2022 | 2 | | 2023 | 2 | | 2024 | 5 | | 2025 | 7 | | 2026 | 55 | ## Affected versions (top 25 of 374) | Version | Kind | CVEs | | --- | --- | --- | | auth-4.0.0 | exact | 35 | | rec-4.0.0 | exact | 35 | | auth-4.0.1 | exact | 34 | | rec-4.0.1 | exact | 34 | | dnsdist-1.1.0-beta1 | exact | 32 | | rec-4.0.2 | exact | 32 | | auth-3.1-rc1 | exact | 30 | | auth-3.1-rc2 | exact | 30 | | auth-3.1-rc3 | exact | 30 | | auth-3.2-rc1 | exact | 30 | | auth-3.2-rc2 | exact | 30 | | auth-3.2-rc3 | exact | 30 | | \<= 8.0 | range | 6 | | \<= 15.1 | range | 5 | | \<= 15.0-sp1 | range | 3 | | \<= 10.0 | range | 2 | | \<= 15.0 | range | 2 | | \<= 31 | range | 2 | | \<= 32 | range | 2 | | \<= 36 | range | 2 | | \< 4.1.2 | range | 1 | | \<= 13.2 | range | 1 | | \<= 15.0-sp2 | range | 1 | | \<= 15.2 | range | 1 | | 4.1.2 | patched | 1 | ## CVEs (first 30 of 110, most severe first) | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-52688 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation | high | 7.5 | No | No | Yes | | CVE-2026-52686 | Wildcard CNAME proof validation bypass | low | 3.7 | No | No | Yes | | CVE-2026-52684 | Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack | low | 3.7 | No | No | Yes | | CVE-2026-42389 | Reject more queries with invalid header values | medium | 5.3 | No | No | Yes | | CVE-2026-52690 | Spoofed answers can mark an authoritative non-EDNS capable | medium | 5.9 | No | No | Yes | | CVE-2026-42390 | ZONEMD validation can be bypassed | medium | 5.3 | No | No | Yes | | CVE-2026-42388 | Missing input validation for catalog zones | medium | 5.9 | No | No | Yes | | CVE-2026-42387 | Insufficient input validation in ZoneToCache | medium | 5.9 | No | No | Yes | | CVE-2026-40012 | Information about ECS zero scoped answers might leak to clients that use a specific ECS | medium | 5.3 | No | No | Yes | | CVE-2026-33612 | ZoneToCache can poison the cache | high | 7.5 | No | No | Yes | | CVE-2026-42004 | EDNS options smuggling | low | 3.7 | No | No | Yes | | CVE-2026-40211 | Denial of service via crafted DoH3 queries | medium | 5.3 | No | No | Yes | | CVE-2026-40210 | Out-of-bounds read in SetMacAddrAction | medium | 4.8 | No | No | Yes | | CVE-2026-40209 | Denial of service via IXFR queries | medium | 5.3 | No | No | Yes | | CVE-2026-40208 | Denial of service via DoH3 queries | low | 3.7 | No | No | Yes | | CVE-2026-40011 | Prometheus denial of service via crafted DNS queries | low | 3.7 | No | No | Yes | | CVE-2026-42005 | Insufficient input validation of internal web server | medium | 4.3 | No | No | Yes | | CVE-2026-41999 | Incorrect Behaviour of Views with TCP PROXY Requests | medium | 4.8 | No | No | Yes | | CVE-2026-42002 | Concurrency and locking defects in GSS-TSIG | high | 7.5 | No | No | Yes | | CVE-2026-42001 | Insufficient Validation of Autoprimary SOA Queries | high | 7.5 | No | No | Yes | | CVE-2026-42000 | Insufficient Validation of Names During AXFR | high | 8.6 | No | No | Yes | | CVE-2026-42396 | Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail | medium | 6.5 | No | No | Yes | | CVE-2026-33611 | Insufficient validation of HTTPS and SVCB records | medium | 6.5 | No | No | Yes | | CVE-2026-33610 | Possible file descriptor exhaustion in forward-dnsupdate | high | 7.5 | No | No | Yes | | CVE-2026-33609 | LDAP DN injection | medium | 6.5 | No | No | Yes | | CVE-2026-33608 | Incomplete domain name sanitization during | critical | 9.8 | No | No | Yes | | CVE-2026-33593 | Denial of service via crafted DNSCrypt query | high | 7.5 | No | No | Yes | | CVE-2026-33594 | Outgoing DoH excessive memory allocation | high | 7.5 | No | No | Yes | | CVE-2026-33595 | DoQ/DoH3 excessive memory allocation | high | 7.5 | No | No | Yes | | CVE-2026-33597 | PRSD detection denial of service | high | 7.5 | No | No | Yes | ## Frequently asked questions ### How many CVEs does PowerDNS pdns have? PowerDNS pdns has 110 published CVE records since 2016. ### How many PowerDNS pdns CVEs are in CISA KEV? None of PowerDNS pdns's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for PowerDNS pdns vulnerabilities? Yes — 2 of PowerDNS pdns's CVEs have a known public exploit. ### Which versions of PowerDNS pdns are affected? 374 distinct PowerDNS pdns versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in PowerDNS pdns CVEs? PowerDNS pdns's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption), CWE-476 (NULL Pointer Dereference). ### How many critical PowerDNS pdns vulnerabilities are there? PowerDNS pdns has 4 critical and 57 high-severity CVEs. ### What is the average severity of PowerDNS pdns CVEs? The average CVSS base score across PowerDNS pdns's scored CVEs is 6.7. ## Other products from this vendor - [Recursor](https://radicalnotion.ai/vendor/powerdns/recursor) (64 CVEs) - [Authoritative](https://radicalnotion.ai/vendor/powerdns/authoritative) (32 CVEs) - [DNSdist](https://radicalnotion.ai/vendor/powerdns/dnsdist) (31 CVEs) - [PowerDNS](https://radicalnotion.ai/vendor/powerdns/powerdns) (9 CVEs) - [authoritative server](https://radicalnotion.ai/vendor/powerdns/authoritative-server) (7 CVEs) - [pdns-recursor](https://radicalnotion.ai/vendor/powerdns/pdns-recursor) (5 CVEs) - [PowerDNS Recursor](https://radicalnotion.ai/vendor/powerdns/powerdns-recursor) (5 CVEs) - [PowerDNS Authoritative](https://radicalnotion.ai/vendor/powerdns/powerdns-authoritative) (1 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/powerdns/pdns). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.