---
title: "PowerDNS Recursor vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/powerdns/recursor
type: product
description: "PowerDNS Recursor has 64 published CVEs, 0 in CISA KEV and 2 with public exploits."
updated: 2026-07-23
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# PowerDNS Recursor vulnerabilities

Vendor: [PowerDNS](https://radicalnotion.ai/vendor/powerdns)

- **Published CVEs:** 64
- **In CISA KEV:** 0
- **With a public exploit:** 2
- **With a patch:** 64
- **Average CVSS:** 6.6
- **First CVE:** 2006-11-14
- **Latest CVE:** 2026-07-23

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 2 |
| High | 30 |
| Medium | 29 |
| Low | 3 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 12 |
| [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 6 |
| [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 5 |
| [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 5 |
| [CWE-345](https://radicalnotion.ai/cwe/cwe-345) | Insufficient Verification of Data Authenticity | 4 |
| [CWE-399](https://radicalnotion.ai/cwe/cwe-399) | Resource Management Errors | 3 |
| [CWE-347](https://radicalnotion.ai/cwe/cwe-347) | Improper Verification of Cryptographic Signature | 3 |
| [CWE-294](https://radicalnotion.ai/cwe/cwe-294) | Authentication Bypass by Capture-replay | 2 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2015 | 2 |
| 2016 | 0 |
| 2017 | 0 |
| 2018 | 13 |
| 2019 | 2 |
| 2020 | 5 |
| 2021 | 0 |
| 2022 | 2 |
| 2023 | 2 |
| 2024 | 4 |
| 2025 | 4 |
| 2026 | 23 |

## Affected versions (top 28 of 151)

| Version | Kind | CVEs |
| --- | --- | --- |
| 4.8.7 | exact | 1 |
| 4.9.4 | exact | 1 |
| 5.0.3 | exact | 1 |
| 5.2.0 \<= v \< 5.2.9 | range | 9 |
| 5.3.0 \<= v \< 5.3.6 | range | 9 |
| 5.4.0 | range | 9 |
| 5.4.0 \<= v \< 5.4.1 | range | 9 |
| 5.4.0 \<= v \< 5.4.3 | range | 7 |
| 3.0 | range | 5 |
| 3.0.1 | range | 5 |
| 3.1.1 | range | 5 |
| 3.1.2 | range | 5 |
| 5.2.0 \<= v \< 5.2.11 | range | 5 |
| 5.3.0 \<= v \< 5.3.8 | range | 5 |
| 2.0\_rc1 | range | 4 |
| 5.2.9 | patched | 9 |
| 5.3.6 | patched | 9 |
| 5.4.1 | patched | 9 |
| 5.4.3 | patched | 7 |
| 5.2.11 | patched | 5 |
| 5.3.8 | patched | 5 |
| 4.0.4 | patched | 3 |
| 3.7.4 | patched | 2 |
| 4.9.3 | patched | 2 |
| 5.0.2 | patched | 2 |
| 5.1.10 | patched | 2 |
| 5.1.8 | patched | 2 |
| No version pinned | default | 1 |

## CVEs (first 30 of 64, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-52688 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation | high | 7.5 | No | No | Yes |
| CVE-2026-52686 | Wildcard CNAME proof validation bypass | low | 3.7 | No | No | Yes |
| CVE-2026-52684 | Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack | low | 3.7 | No | No | Yes |
| CVE-2026-42389 | Reject more queries with invalid header values | medium | 5.3 | No | No | Yes |
| CVE-2026-52690 | Spoofed answers can mark an authoritative non-EDNS capable | medium | 5.9 | No | No | Yes |
| CVE-2026-42390 | ZONEMD validation can be bypassed | medium | 5.3 | No | No | Yes |
| CVE-2026-42388 | Missing input validation for catalog zones | medium | 5.9 | No | No | Yes |
| CVE-2026-42387 | Insufficient input validation in ZoneToCache | medium | 5.9 | No | No | Yes |
| CVE-2026-40012 | Information about ECS zero scoped answers might leak to clients that use a specific ECS | medium | 5.3 | No | No | Yes |
| CVE-2026-33612 | ZoneToCache can poison the cache | high | 7.5 | No | No | Yes |
| CVE-2026-33262 | Insufficient validation of cookie reply | medium | 5.9 | No | No | Yes |
| CVE-2026-33261 | Null pointer accces in aggressive NSEC(3) cache | medium | 5.9 | No | No | Yes |
| CVE-2026-33260 | Insufficient input validation of internal webserver | high | 7.5 | No | No | Yes |
| CVE-2026-33259 | Concurrent modification of RPZ data can lead to denial of servce | medium | 5.0 | No | No | Yes |
| CVE-2026-33258 | Crafted zones can cause increased resource usage | high | 7.5 | No | No | Yes |
| CVE-2026-33257 | Insufficient input validation of internal webserver | high | 7.5 | No | No | Yes |
| CVE-2026-33256 | Unbounded memory allocation by internal web server | high | 7.5 | No | No | Yes |
| CVE-2026-33601 | Insufficient validation of zonemd record | medium | 4.9 | No | No | Yes |
| CVE-2026-33600 | Null pointer dereference in RPZ transfer | medium | 4.9 | No | No | Yes |
| CVE-2025-59024 | Crafted delegations or IP fragments can poison cached delegations in Recursor | medium | 6.5 | No | No | Yes |
| CVE-2025-59023 | Crafted delegations or IP fragments can poison cached delegations in Recursor | high | 8.2 | No | No | Yes |
| CVE-2026-24027 | Crafted zones can lead to increased incoming network traffic | medium | 5.3 | No | No | Yes |
| CVE-2026-0398 | Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor | medium | 5.3 | No | No | Yes |
| CVE-2025-59029 | Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor | medium | 5.3 | No | No | Yes |
| CVE-2025-59030 | Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor | high | 7.5 | No | No | Yes |
| CVE-2025-30192 | A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts | high | 7.5 | No | No | Yes |
| CVE-2025-30195 | A crafted zone can lead to an illegal memory access in the PowerDNS Recursor | high | 7.5 | No | No | Yes |
| CVE-2024-25590 | Crafted responses can lead to a denial of service due to cache inefficiencies in the Recursor | high | 7.5 | No | No | Yes |
| CVE-2024-25583 | Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured | high | 7.5 | No | No | Yes |
| CVE-2023-50868 | - | high | 7.5 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does PowerDNS Recursor have?

PowerDNS Recursor has 64 published CVE records since 2006.

### How many PowerDNS Recursor CVEs are in CISA KEV?

None of PowerDNS Recursor's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for PowerDNS Recursor vulnerabilities?

Yes — 2 of PowerDNS Recursor's CVEs have a known public exploit.

### Which versions of PowerDNS Recursor are affected?

151 distinct PowerDNS Recursor versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in PowerDNS Recursor CVEs?

PowerDNS Recursor's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-476 (NULL Pointer Dereference), CWE-400 (Uncontrolled Resource Consumption).

### How many critical PowerDNS Recursor vulnerabilities are there?

PowerDNS Recursor has 2 critical and 30 high-severity CVEs.

### What is the average severity of PowerDNS Recursor CVEs?

The average CVSS base score across PowerDNS Recursor's scored CVEs is 6.6.

## Other products from this vendor

- [pdns](https://radicalnotion.ai/vendor/powerdns/pdns) (110 CVEs)
- [Authoritative](https://radicalnotion.ai/vendor/powerdns/authoritative) (32 CVEs)
- [DNSdist](https://radicalnotion.ai/vendor/powerdns/dnsdist) (31 CVEs)
- [PowerDNS](https://radicalnotion.ai/vendor/powerdns/powerdns) (9 CVEs)
- [authoritative server](https://radicalnotion.ai/vendor/powerdns/authoritative-server) (7 CVEs)
- [pdns-recursor](https://radicalnotion.ai/vendor/powerdns/pdns-recursor) (5 CVEs)
- [PowerDNS Recursor](https://radicalnotion.ai/vendor/powerdns/powerdns-recursor) (5 CVEs)
- [PowerDNS Authoritative](https://radicalnotion.ai/vendor/powerdns/powerdns-authoritative) (1 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/powerdns/recursor). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.