An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-05.html Vendor Advisory
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html Broken Link, Vendor Advisory
- https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · powerdnsNVD modified 2026-10-26 22:10
Affected (CPE criteria) 4
cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*cpe:2.3:a:powerdns:dnsdist:*:*:*:*:*:*:*:*cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*cpe:2.3:a:powerdns:recursor:5.4.0:*:*:*:*:*:*:*
References 3
- https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-05.html Vendor Advisory
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-03.html Broken Link, Vendor Advisory
- https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-04.html Vendor Advisory