Deadlock in PowerDNS Recursor - CVE-2026-85557
Published: October 21, 2026
Vulnerability identifier: #VU156688
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85557
CWE-ID: CWE-833
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service on the PowerDNS Recursor internal web access port.
The vulnerability exists due to a deadlock condition in the internal web server when handling an incoming connection that does not complete its TLS handshake. A remote attacker can connect without completing the handshake to monopolize web access and prevent other clients from using the web service.
TLS is not enabled by default for the internal web server.
Affected software
PowerDNS Recursor
How to mitigate CVE-2026-85557
Install security update from vendor's website.
PowerDNS Recursor - addressed in versions 5.3.12, 5.4.8