Powerdns

Recursor

54 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.9

CVE-2026-33601

  • EPSS 0.01%
  • Veröffentlicht 22.04.2026 10:16:52
  • Zuletzt bearbeitet 27.04.2026 16:58:57

If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

5.9

CVE-2026-33262

  • EPSS 0.01%
  • Veröffentlicht 22.04.2026 10:16:51
  • Zuletzt bearbeitet 27.04.2026 17:02:49

An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default.

5.9

CVE-2026-33261

  • EPSS 0%
  • Veröffentlicht 22.04.2026 10:16:51
  • Zuletzt bearbeitet 27.04.2026 17:03:09

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

7.5

CVE-2026-33260

  • EPSS 0.01%
  • Veröffentlicht 22.04.2026 10:16:51
  • Zuletzt bearbeitet 27.04.2026 17:03:22

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

5

CVE-2026-33259

  • EPSS 0%
  • Veröffentlicht 22.04.2026 10:16:51
  • Zuletzt bearbeitet 27.04.2026 17:03:35

Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.

7.5

CVE-2026-33258

  • EPSS 0%
  • Veröffentlicht 22.04.2026 10:16:51
  • Zuletzt bearbeitet 27.04.2026 17:03:45

By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.

7.5

CVE-2026-33257

  • EPSS 0.01%
  • Veröffentlicht 22.04.2026 10:16:51
  • Zuletzt bearbeitet 27.04.2026 17:03:56

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

7.5

CVE-2026-33256

  • EPSS 0%
  • Veröffentlicht 22.04.2026 10:16:51
  • Zuletzt bearbeitet 27.04.2026 17:04:04

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

4.9

CVE-2026-33600

  • EPSS 0.02%
  • Veröffentlicht 22.04.2026 09:33:12
  • Zuletzt bearbeitet 27.04.2026 16:59:23

An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

6.5

CVE-2025-59024

  • EPSS 0%
  • Veröffentlicht 09.02.2026 14:44:28
  • Zuletzt bearbeitet 20.04.2026 15:11:15

Crafted delegations or IP fragments can poison cached delegations in Recursor.