Latest PowerDNS Recursor vulnerabilities #
PowerDNS has disclosed multiple vulnerabilities affecting certain versions of PowerDNS Recursor stemming from Recursor not applying strict enough validation of received delegation information — the records that tell a resolver which nameservers are authoritative for a specific domain. This allows a remote, unauthenticated adversary to poison cached delegations in the following ways:
- By sending spoofed packets containing malicious delegation information. This vulnerability has been designated CVE-2025-59023 and has been rated high with a CVSS score of 8.2.
- By sending spoofed packets performing a UDP fragmentation attack. This vulnerability has been designated CVE-2025-59024 and has been rated medium with a CVSS score of 6.5.
The following versions are affected
- PowerDNS Recursor versions 5.1.x prior to 5.1.8
- PowerDNS Recursor versions 5.2.x prior to 5.2.6
- PowerDNS Recursor versions 5.3.x prior to 5.3.1
What is PowerDNS Recursor? #
PowerDNS Recursor is an open-source DNS resolving server that answers client queries by recursively querying authoritative nameservers and caching the results, distinguishing itself with a powerful, built-in Lua scripting engine that allows for advanced, fine-grained control over the resolving behavior.
What is the impact? #
Successful exploitation of the vulnerability would allow an adversary to identify security credentials or tokens used internally by web applications using Squid for backend load balancing.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- PowerDNS Recursor versions 5.1.x upgrade to version 5.1.8 or later
- PowerDNS Recursor versions 5.2.x upgrade to version 5.2.6 or later
- PowerDNS Recursor versions 5.3.x upgrade to version 5.3.1 or later
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=PowerDNS AND product:=Recursor AND (version:>0 AND (
(version:>=5.1 AND version:<5.1.8) OR
(version:>=5.2 AND version:<5.2.6) OR
(version:>=5.3 AND version:<5.3.1)))
