#VU15961 Improper input validation in PowerDNS Recursor and PowerDNS Authoritative

Published: 2018-11-19

Vulnerability identifier: #VU15961

Vulnerability risk: Low


CVE-ID: CVE-2018-14626


Exploitation vector: Network

Exploit availability: No

Vulnerable software:
PowerDNS Recursor
Server applications / DNS servers
PowerDNS Authoritative
Server applications / DNS servers

Vendor: PowerDNS.COM B.V.


The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to DNSSEC validating clients consider the answer to be bogus until it expires from the packet cache. A remote attacker can craft a DNS query, cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype.

The vulnerability has been fixed in the versions 4.1.5.

Vulnerable software versions

PowerDNS Recursor: 4.1.0 - 4.1.4, 4.0.0 - 4.0.9

PowerDNS Authoritative: 4.1.0 - 4.1.4, 4.0.0 - 4.0.9


External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Latest bulletins with this vulnerability