CVE-2025-59029: Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor
Published Dec 9, 2025
·Updated
An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.
Affected Software
3 affected components
PowerDNS recursor
PowerDNS recursor=5.3.0
PowerDNS recursor=5.3.1
Event History
Dec 9, 2025
CVE Published
via MITRE·09:16 AM
Data Sourced
via MITRE·09:16 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-59029?
CVE-2025-59029 has a high severity due to the potential for assertion failure leading to service disruption.
2
How do I fix CVE-2025-59029?
To fix CVE-2025-59029, update the PowerDNS Recursor to the latest version available that addresses the vulnerability.
3
What software is affected by CVE-2025-59029?
CVE-2025-59029 affects the PowerDNS Recursor, which is vulnerable to crafted DNS record queries.
4
What is the exploit method for CVE-2025-59029?
The exploit method for CVE-2025-59029 involves sending crafted DNS records followed by a query with the qtype set to ANY.
5
What impact does CVE-2025-59029 have on system security?
CVE-2025-59029 can lead to denial of service by causing assertion failures in the DNS records cache.