# PowerDNS Recursor. Every CVE that names PowerDNS Recursor among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation](https://agentprime.io/advisories/CVE-2026-52688.md) `CVE-2026-52688` · CVE record: PowerDNS Recursor · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Weak cryptography or TLS, CWE-345 - [Wildcard CNAME proof validation bypass](https://agentprime.io/advisories/CVE-2026-52686.md) `CVE-2026-52686` · CVE record: PowerDNS Recursor · CVSS 3.7 Low · Not analysed yet · Published 23 Jul 2026 · Tags: Weak cryptography or TLS - [Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack](https://agentprime.io/advisories/CVE-2026-52684.md) `CVE-2026-52684` · CVE record: PowerDNS Recursor · CVSS 3.7 Low · Not analysed yet · Published 23 Jul 2026 - [Reject more queries with invalid header values](https://agentprime.io/advisories/CVE-2026-42389.md) `CVE-2026-42389` · CVE record: PowerDNS Recursor · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-20 - [Spoofed answers can mark an authoritative non-EDNS capable](https://agentprime.io/advisories/CVE-2026-52690.md) `CVE-2026-52690` · CVE record: PowerDNS Recursor · CVSS 5.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Authentication bypass - [ZONEMD validation can be bypassed](https://agentprime.io/advisories/CVE-2026-42390.md) `CVE-2026-42390` · CVE record: PowerDNS Recursor · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-20 - [Missing input validation for catalog zones](https://agentprime.io/advisories/CVE-2026-42388.md) `CVE-2026-42388` · CVE record: PowerDNS Recursor · CVSS 5.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-20 - [Insufficient input validation in ZoneToCache](https://agentprime.io/advisories/CVE-2026-42387.md) `CVE-2026-42387` · CVE record: PowerDNS Recursor · CVSS 5.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-20 - [Information about ECS zero scoped answers might leak to clients that use a specific ECS](https://agentprime.io/advisories/CVE-2026-40012.md) `CVE-2026-40012` · CVE record: PowerDNS Recursor · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-524 - [ZoneToCache can poison the cache](https://agentprime.io/advisories/CVE-2026-33612.md) `CVE-2026-33612` · CVE record: PowerDNS Recursor · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-349 - [Insufficient validation of cookie reply](https://agentprime.io/advisories/CVE-2026-33262.md) `CVE-2026-33262` · CVE record: PowerDNS Recursor · CVSS 5.9 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Memory corruption - [Null pointer accces in aggressive NSEC(3) cache](https://agentprime.io/advisories/CVE-2026-33261.md) `CVE-2026-33261` · CVE record: PowerDNS Recursor · CVSS 5.9 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-353 - [Insufficient input validation of internal webserver](https://agentprime.io/advisories/CVE-2026-33260.md) `CVE-2026-33260` · CVE record: PowerDNS Authoritative and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Denial of service - [Concurrent modification of RPZ data can lead to denial of servce](https://agentprime.io/advisories/CVE-2026-33259.md) `CVE-2026-33259` · CVE record: PowerDNS Recursor · CVSS 5.0 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Memory corruption - [Crafted zones can cause increased resource usage](https://agentprime.io/advisories/CVE-2026-33258.md) `CVE-2026-33258` · CVE record: PowerDNS Recursor · CVSS 5.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Denial of service - [Insufficient input validation of internal webserver](https://agentprime.io/advisories/CVE-2026-33257.md) `CVE-2026-33257` · CVE record: PowerDNS Authoritative and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Denial of service - [Unbounded memory allocation by internal web server](https://agentprime.io/advisories/CVE-2026-33256.md) `CVE-2026-33256` · CVE record: PowerDNS Recursor · CVSS 5.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Denial of service - [Insufficient validation of zonemd record](https://agentprime.io/advisories/CVE-2026-33601.md) `CVE-2026-33601` · CVE record: PowerDNS Recursor · CVSS 4.4 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Memory corruption - [Null pointer dereference in RPZ transfer](https://agentprime.io/advisories/CVE-2026-33600.md) `CVE-2026-33600` · CVE record: PowerDNS Recursor · CVSS 4.4 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Memory corruption - [Crafted delegations or IP fragments can poison cached delegations in Recursor](https://agentprime.io/advisories/CVE-2025-59024.md) `CVE-2025-59024` · CVE record: PowerDNS Recursor · CVSS 6.5 Medium · Not analysed yet · Published 9 Feb 2026 - [Crafted delegations or IP fragments can poison cached delegations in Recursor](https://agentprime.io/advisories/CVE-2025-59023.md) `CVE-2025-59023` · CVE record: PowerDNS Recursor · CVSS 8.2 High · Not analysed yet · Published 9 Feb 2026 - [Crafted zones can lead to increased incoming network traffic](https://agentprime.io/advisories/CVE-2026-24027.md) `CVE-2026-24027` · CVE record: PowerDNS Recursor · CVSS 5.3 Medium · Not analysed yet · Published 9 Feb 2026 - [Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor](https://agentprime.io/advisories/CVE-2026-0398.md) `CVE-2026-0398` · CVE record: PowerDNS Recursor · CVSS 5.3 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Denial of service - [Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor](https://agentprime.io/advisories/CVE-2025-59029.md) `CVE-2025-59029` · CVE record: PowerDNS Recursor · CVSS 5.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Denial of service - [Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor](https://agentprime.io/advisories/CVE-2025-59030.md) `CVE-2025-59030` · CVE record: PowerDNS Recursor · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: Broken access control - [A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts](https://agentprime.io/advisories/CVE-2025-30192.md) `CVE-2025-30192` · CVE record: PowerDNS Recursor · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2025 · Tags: CWE-345 - [A crafted zone can lead to an illegal memory access in the PowerDNS Recursor](https://agentprime.io/advisories/CVE-2025-30195.md) `CVE-2025-30195` · CVE record: PowerDNS Recursor · CVSS 7.5 High · Not analysed yet · Published 7 Apr 2025 · Tags: Memory corruption - [Crafted responses can lead to a denial of service due to cache inefficiencies in the Recursor](https://agentprime.io/advisories/CVE-2024-25590.md) `CVE-2024-25590` · CVE record: PowerDNS Recursor · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2024 · Tags: CWE-20 - [Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured](https://agentprime.io/advisories/CVE-2024-25583.md) `CVE-2024-25583` · CVE record: PowerDNS Recursor · CVSS 7.5 High · Not analysed yet · Published 25 Apr 2024 · Tags: CWE-20 - [Deterred spoofing attempts can lead to authoritative servers being marked unavailable](https://agentprime.io/advisories/CVE-2023-26437.md) `CVE-2023-26437` · CVE record: PowerDNS Recursor · CVSS 3.4 Low · Not analysed yet · Published 4 Apr 2023 · Tags: Denial of service - [Memory leak in PowerDNS Recursor](https://agentprime.io/advisories/CVE-2017-15094.md) `CVE-2017-15094` · CVE record: PowerDNS PowerDNS Recursor · No CVSS score · Not analysed yet · Published 23 Jan 2018 · Tags: Denial of service - [Improper input validation in PowerDNS Recursor](https://agentprime.io/advisories/CVE-2017-15093.md) `CVE-2017-15093` · CVE record: PowerDNS PowerDNS Recursor · No CVSS score · Not analysed yet · Published 23 Jan 2018 · Tags: CWE-20 - [Cross-site scripting in PowerDNS Recursor](https://agentprime.io/advisories/CVE-2017-15092.md) `CVE-2017-15092` · CVE record: PowerDNS PowerDNS Recursor · No CVSS score · Not analysed yet · Published 23 Jan 2018 · Tags: Cross-site scripting (XSS) ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .