SB2026102192 - Multiple vulnerabilities in PowerDNS Recursor
Published: October 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-73206)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service in PowerDNS Recursor.
The vulnerability exists due to insufficient resource limits in DNS name decompression when processing compression pointers in DNS packets. A remote attacker can send a specially crafted DNS reply from a malicious server to trigger excessive resource consumption and cause a denial of service.
2) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-73205)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by preventing PowerDNS Recursor from opening new outgoing TCP connections.
The vulnerability exists due to improper resource lifecycle management in outgoing TCP connection handling when closed connections retain operating system resources in the TIME_WAIT state. A remote attacker can induce excessive numbers of these connections to exhaust available resources and prevent new connections to authoritative servers.
3) Insufficient verification of data authenticity (CVE-ID: CVE-2026-85555)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass DNSSEC validation and poison the DNS cache in PowerDNS Recursor.
The vulnerability exists due to insufficient verification of data authenticity in DNSSEC validation when resolving an NS name that refers to an out-of-band local zone. A remote attacker can exploit the validation exemption extending beyond NS name resolution to have subsequent query processing skip DNSSEC validation and permit cache poisoning.
4) Input validation error (CVE-ID: CVE-2026-85556)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass EDNS Client Subnet hardening in PowerDNS Recursor and cause acceptance of an EDNS option that should be rejected.
The vulnerability exists due to missing owner-name validation in OPT resource record handling when processing EDNS records whose owner is not the DNS root. A remote attacker can supply a specially crafted record with a non-root owner name to bypass the validation checks and have an EDNS option accepted incorrectly.
5) Deadlock (CVE-ID: CVE-2026-85557)
CWE-ID: CWE-833 - Deadlock
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service on the PowerDNS Recursor internal web access port.
The vulnerability exists due to a deadlock condition in the internal web server when handling an incoming connection that does not complete its TLS handshake. A remote attacker can connect without completing the handshake to monopolize web access and prevent other clients from using the web service.
TLS is not enabled by default for the internal web server.
6) Memory leak (CVE-ID: CVE-2026-85558)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to consume memory without bounds and degrade the availability of PowerDNS Recursor.
The vulnerability exists due to a memory leak in incoming TCP client address tracking when connections close without their stored client addresses being cleaned up. A remote attacker can repeatedly establish and close incoming TCP connections to accumulate retained address data and cause excessive memory consumption.
7) Out-of-bounds read (CVE-ID: CVE-2026-85559)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through a potential crash of PowerDNS Recursor.
The vulnerability exists due to an out-of-bounds read in findScopeZero when checking incoming EDNS Client Subnet data using an incorrect length bound. A remote attacker can supply specially crafted input to trigger a read beyond the valid bounds and potentially crash the Recursor.
The issue only applies when incoming.use_incoming_edns_subnet is enabled.
Remediation
Install update from vendor's website.