UBUNTU-CVE-2026-85559
[Out-of-bounds read in Recursor findScopeZero]
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости pdns-recursor
За последние 30 дней в pdns-recursor опубликовано уязвимостей: 7; в каталоге KEV: 0.
Уязвимостей: 76
UBUNTU-CVE-2026-85558
[Recursor retains closed TCP client addresses until process exit]
Опубликовано ОбновленоUBUNTU-CVE-2026-85557
[Single web client not doing TLS handshake monopolizes web access]
Опубликовано ОбновленоUBUNTU-CVE-2026-85556
[Missing OPT RR owner-name validation bypasses ECS hardening]
Опубликовано ОбновленоUBUNTU-CVE-2026-85555
[DNSSEC validation bypass and cache poisoning in PowerDNS Recursor via out-of-band NS resolution]
Опубликовано ОбновленоUBUNTU-CVE-2026-73206
[A crafted DNS packet can cause a denial of service decompressing the DNS names in the packet]
Опубликовано ОбновленоUBUNTU-CVE-2026-73205
[A malicious client can cause too many TCP connections in TIME_WAIT state]
Опубликовано ОбновленоUBUNTU-CVE-2026-52682
[A crafted DNS packet can cause increased memory and CPU consumption]
Опубликовано ОбновленоRRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
Опубликовано ОбновленоWildcard CNAME proof validation bypass
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
Опубликовано ОбновленоPrefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.
Опубликовано ОбновленоSpoofed answers can mark an authoritative non-EDNS capable
Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.
Опубликовано ОбновленоZONEMD validation can be bypassed
An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.
Опубликовано ОбновленоMissing input validation for catalog zones
Incomplete validation of the SOA record present in a catalog zone might lead to a crash.
Опубликовано ОбновленоInsufficient input validation in ZoneToCache
A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.
Опубликовано ОбновленоInformation about ECS zero scoped answers might leak to clients that use a specific ECS
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
Опубликовано ОбновленоZoneToCache can poison the cache
A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.
Опубликовано ОбновленоInsufficient input validation of internal web server
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Опубликовано ОбновленоInsufficient validation of cookie reply
An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default.
Опубликовано ОбновленоNull pointer accces in aggressive NSEC(3) cache
A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.