CVE-2025-59030: Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
Published Dec 9, 2025
·Updated
An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.
Affected Software
3 affected components
PowerDNS recursor>=5.1.0<5.1.9
PowerDNS recursor>=5.2.0<5.2.7
PowerDNS recursor>=5.3.0<5.3.3
Event History
Dec 9, 2025
CVE Published
via MITRE·09:15 AM
Data Sourced
via MITRE·09:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-59030?
The severity of CVE-2025-59030 is classified as high due to its potential for causing a denial of service.
2
How do I fix CVE-2025-59030?
To fix CVE-2025-59030, upgrade PowerDNS Recursor to versions 5.1.9 or later, 5.2.7 or later, or 5.3.3 or later.
3
What are the affected versions of PowerDNS Recursor for CVE-2025-59030?
The affected versions for CVE-2025-59030 include PowerDNS Recursor versions from 5.1.0 to 5.1.9, 5.2.0 to 5.2.7, and 5.3.0 to 5.3.3.
4
What kind of attack does CVE-2025-59030 enable?
CVE-2025-59030 enables an attacker to trigger a denial of service by sending a NOTIFY query over TCP.
5
Can CVE-2025-59030 affect my DNS services?
Yes, CVE-2025-59030 can impact DNS services by allowing the removal of cached records, potentially leading to disruptions.