Today we have released PowerDNS Authoritative Server 4.9.17, 5.0.7, 5.1.4, Recursor 5.2.13, 5.3.10, 5.4.5, and dnsdist 1.9.16, 2.0.8, 2.1.1.

These releases provide fixes for PowerDNS Security Advisory

2026-11 for PowerDNS Authoritative Server, Recursor and dnsdist: A crafted DNS packet can cause increased memory and CPU consumption

The CVE associated with this advisory is of severity High.

CVE-2026-52682: A crafted DNS packet can cause increased memory and CPU consumption

Please refer to the changelogs for Authoritative Server ([1]4.9.17, [2]5.0.7, [3]5.1.4), Recursor ([4]5.2.13, [5]5.3.10 and [6]5.4.5) and dnsdist ([7]1.9.16, [8]2.0.8, [9]2.1.1) and the full [10]security advisory for additional details.

Please send us all feedback and issues you might have via the [11]mailing list, or in case of a bug, via [12]GitHub.

The tarballs for Authoritative Server ([13]4.9.17, [14]5.0.7, [15]5.1.4 with signature files [16]4.9.17, [17]5.0.7, [18]5.1.4), Recursor ([19]5.2.13, [20]5.3.10, [21]5.4.5 with signature files [22]5.2.13, [23]5.3.10, [24]5.4.5) and dnsdist ([25]1.9.16, [26]2.0.8, [27]2.1.1 with signature files [28]1.9.16, [29]2.0.8, [30]2.1.1) are available from our download [31]server and packages for several distributions are available from our [32]repository.

Recently we made changes to our Open Source End of Life policy. Older release trains are now supported for one year after the following major release. Consult the EOL [33]policy for more details.

We are grateful to the PowerDNS community for the reporting of bugs, issues, feature requests, and especially to the submitters of fixes and implementations of features.

References

1. https://docs.powerdns.com/authoritative/changelog/4.9.html#change-4.9.17 2. https://docs.powerdns.com/authoritative/changelog/5.0.html#change-5.0.7 3. https://docs.powerdns.com/authoritative/changelog/5.1.html#change-5.1.4 4. https://doc.powerdns.com/recursor/changelog/5.2.html#change-5.2.13 5. https://doc.powerdns.com/recursor/changelog/5.3.html#change-5.3.10 6. https://doc.powerdns.com/recursor/changelog/5.4.html#change-5.4.5 7. https://www.dnsdist.org/changelog.html#change-1.9.16 8. https://www.dnsdist.org/changelog.html#change-2.0.8 9. https://www.dnsdist.org/changelog.html#change-2.1.1 10. https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-11.html 11. https://mailman.powerdns.com/mailman/listinfo/pdns-users 12. https://github.com/PowerDNS/pdns/issues/new/choose 13. https://downloads.powerdns.com/releases/pdns-4.9.17.tar.bz2 14. https://downloads.powerdns.com/releases/pdns-5.0.7.tar.bz2 15. https://downloads.powerdns.com/releases/pdns-5.1.4.tar.bz2 16. https://downloads.powerdns.com/releases/pdns-4.9.17.tar.bz2.sig 17. https://downloads.powerdns.com/releases/pdns-5.0.7.tar.bz2.sig 18. https://downloads.powerdns.com/releases/pdns-5.1.4.tar.bz2.sig 19. https://downloads.powerdns.com/releases/pdns-recursor-5.2.13.tar.bz2 20. https://downloads.powerdns.com/releases/pdns-recursor-5.3.10.tar.xz 21. https://downloads.powerdns.com/releases/pdns-recursor-5.4.5.tar.xz 22. https://downloads.powerdns.com/releases/pdns-recursor-5.2.13.tar.bz2.sig 23. https://downloads.powerdns.com/releases/pdns-recursor-5.3.10.tar.xz.sig 24. https://downloads.powerdns.com/releases/pdns-recursor-5.4.5.tar.xz.sig 25. https://downloads.powerdns.com/releases/dnsdist-1.9.16.tar.bz2 26. https://downloads.powerdns.com/releases/dnsdist-2.0.8.tar.xz 27. https://downloads.powerdns.com/releases/dnsdist-2.1.1.tar.xz 28. https://downloads.powerdns.com/releases/dnsdist-1.9.16.tar.bz2.sig 29. https://downloads.powerdns.com/releases/dnsdist-2.0.8.tar.xz.sig 30. https://downloads.powerdns.com/releases/dnsdist-2.1.1.tar.xz.sig 31. https://downloads.powerdns.com/releases/ 32. https://repo.powerdns.com/ 33. https://docs.powerdns.com/recursor/appendices/EOL.html

--

kind regards, Otto Moerbeek Developer PowerDNS

Phone: +49 2761 75252 00 Fax: +49 2761 75252 30 Email: otto.moerbeek () powerdns com

------------------------------------------------------------------------------------- Open-Xchange AG, Hohenzollernring 72, 50672 Cologne, District Court Cologne HRB 95366 Managing Board: Andreas Gauger, Dirk Valbert Chairman of the Board: Dr. Paul-Josef Patt

PowerDNS.com B.V., Koninginnegracht 5, 2514 AA Den Haag, The Netherlands Managing Director: Robert Brandt -------------------------------------------------------------------------------------

It has been brought to our attention that the CVE number of the second issue is wrong. It should be CVE-2026-52686.

Regards, Otto On 22/07/2026 13:54 CEST Otto Moerbeek <otto.moerbeek () powerdns com> wrote:

Today we have released PowerDNS Recursor 5.2.12, 5.3.9 and 5.4.4.

These releases provide fixes for PowerDNS Security Advisory

2026-10 for PowerDNS Recursor: Multiple issues

There are two CVEs associated with this advisory, one with severity High and one with severity Low.

CVE-2026-52688: RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation CVE-2026-62686: Wildcard CNAME proof validation bypass

Please refer to the changelogs ([1]5.2.12, [2]5.3.9 and [3]5.4.4) and the full [4]security advisory for additional details.

Please send us all feedback and issues you might have via the [5]mailing list, or in case of a bug, via [6]GitHub.

The tarballs ([7]5.2.12, [8]5.3.9, [9]5.4.4) (with signature files [10]5.2.12, [11]5.3.9, [12]5.4.4) are available from our download [13]server and packages for several distributions are available from our [14]repository.

Recently we made changes to our Open Source End of Life policy. Older release trains are now supported for one year after the following major release. Consult the EOL [15]policy for more details.

We are grateful to the PowerDNS community for the reporting of bugs, issues, feature requests, and especially to the submitters of fixes and implementations of features.

References

1. https://doc.powerdns.com/recursor/changelog/5.2.html#change-5.2.12 2. https://doc.powerdns.com/recursor/changelog/5.3.html#change-5.3.9 3. https://doc.powerdns.com/recursor/changelog/5.4.html#change-5.4.4 4. https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html 5. https://mailman.powerdns.com/mailman/listinfo/pdns-users 6. https://github.com/PowerDNS/pdns/issues/new/choose 7. https://downloads.powerdns.com/releases/pdns-recursor-5.2.12.tar.bz2 8. https://downloads.powerdns.com/releases/pdns-recursor-5.3.9.tar.xz 9. https://downloads.powerdns.com/releases/pdns-recursor-5.4.4.tar.xz 10. https://downloads.powerdns.com/releases/pdns-recursor-5.2.12.tar.bz2.sig 11. https://downloads.powerdns.com/releases/pdns-recursor-5.3.9.tar.xz.sig 12. https://downloads.powerdns.com/releases/pdns-recursor-5.4.4.tar.xz.sig 13. https://downloads.powerdns.com/releases/ 14. https://repo.powerdns.com/ 15. https://docs.powerdns.com/recursor/appendices/EOL.html --

kind regards, Otto Moerbeek Developer PowerDNS

Phone: +49 2761 75252 00 Fax: +49 2761 75252 30 Email: otto.moerbeek () powerdns com

------------------------------------------------------------------------------------- Open-Xchange AG, Hohenzollernring 72, 50672 Cologne, District Court Cologne HRB 95366 Managing Board: Andreas Gauger, Dirk Valbert Chairman of the Board: Dr. Paul-Josef Patt

PowerDNS.com B.V., Koninginnegracht 5, 2514 AA Den Haag, The Netherlands Managing Director: Robert Brandt -------------------------------------------------------------------------------------

Today we have released PowerDNS Recursor 5.2.12, 5.3.9 and 5.4.4.

These releases provide fixes for PowerDNS Security Advisory

2026-10 for PowerDNS Recursor: Multiple issues

There are two CVEs associated with this advisory, one with severity High and one with severity Low.

CVE-2026-52688: RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation CVE-2026-62686: Wildcard CNAME proof validation bypass

Please refer to the changelogs ([1]5.2.12, [2]5.3.9 and [3]5.4.4) and the full [4]security advisory for additional details.

Please send us all feedback and issues you might have via the [5]mailing list, or in case of a bug, via [6]GitHub.

The tarballs ([7]5.2.12, [8]5.3.9, [9]5.4.4) (with signature files [10]5.2.12, [11]5.3.9, [12]5.4.4) are available from our download [13]server and packages for several distributions are available from our [14]repository.

Recently we made changes to our Open Source End of Life policy. Older release trains are now supported for one year after the following major release. Consult the EOL [15]policy for more details.

We are grateful to the PowerDNS community for the reporting of bugs, issues, feature requests, and especially to the submitters of fixes and implementations of features.

References

1. https://doc.powerdns.com/recursor/changelog/5.2.html#change-5.2.12 2. https://doc.powerdns.com/recursor/changelog/5.3.html#change-5.3.9 3. https://doc.powerdns.com/recursor/changelog/5.4.html#change-5.4.4 4. https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html 5. https://mailman.powerdns.com/mailman/listinfo/pdns-users 6. https://github.com/PowerDNS/pdns/issues/new/choose 7. https://downloads.powerdns.com/releases/pdns-recursor-5.2.12.tar.bz2 8. https://downloads.powerdns.com/releases/pdns-recursor-5.3.9.tar.xz 9. https://downloads.powerdns.com/releases/pdns-recursor-5.4.4.tar.xz 10. https://downloads.powerdns.com/releases/pdns-recursor-5.2.12.tar.bz2.sig 11. https://downloads.powerdns.com/releases/pdns-recursor-5.3.9.tar.xz.sig 12. https://downloads.powerdns.com/releases/pdns-recursor-5.4.4.tar.xz.sig 13. https://downloads.powerdns.com/releases/ 14. https://repo.powerdns.com/ 15. https://docs.powerdns.com/recursor/appendices/EOL.html

Today we have released PowerDNS Recursor 5.2.11, 5.3.8 and 5.4.3.

These releases provide fixes for PowerDNS Security Advisory

2026-08 for PowerDNS Recursor: Multiple issues

There are several CVEs associated with this advisory, the first with severity High (but only applicable to specific configurations), the rest of severity Medium.

CVE-2026-33612: ZoneToCache can poison the cache CVE-2026-40012: Information about ECS zero scoped answers might leak to clients that use a specific ECS CVE-2026-42005: Unbounded resource consumption in internal webserver CVE-2026-42390: ZONEMD validation can be bypassed CVE-2026-42389: Reject more queries with invalid header values CVE-2026-42388: Missing input validation for catalog zones CVE-2026-42387: Insufficient input validation in ZoneToCache CVE-2026-52690: Spoofed answers can mark an authoritative non-EDNS capable

Please refer to the changelogs ([1]5.2.11, [2]5.3.8 and [3]5.4.3) and the full [4]security advisory for additional details.

Please send us all feedback and issues you might have via the [5]mailing list, or in case of a bug, via [6]GitHub.

The tarballs ([7]5.2.11, [8]5.3.8, [9]5.4.3) (with signature files [10]5.2.11, [11]5.3.8, [12]5.4.3) are available from our download [13]server and packages for several distributions are available from our [14]repository.

Recently we made changes to our Open Source End of Life policy. Older release trains are now supported for one year after the following major release. Consult the EOL [15]policy for more details.

We are grateful to the PowerDNS community for the reporting of bugs, issues, feature requests, and especially to the submitters of fixes and implementations of features.

References

1. https://doc.powerdns.com/recursor/changelog/5.2.html#change-5.2.11 2. https://doc.powerdns.com/recursor/changelog/5.3.html#change-5.3.8 3. https://doc.powerdns.com/recursor/changelog/5.4.html#change-5.4.3 4. https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-08.html 5. https://mailman.powerdns.com/mailman/listinfo/pdns-users 6. https://github.com/PowerDNS/pdns/issues/new/choose 7. https://downloads.powerdns.com/releases/pdns-recursor-5.2.11.tar.bz2 8. https://downloads.powerdns.com/releases/pdns-recursor-5.3.8.tar.xz 9. https://downloads.powerdns.com/releases/pdns-recursor-5.4.3.tar.xz 10. https://downloads.powerdns.com/releases/pdns-recursor-5.2.11.tar.bz2.sig 11. https://downloads.powerdns.com/releases/pdns-recursor-5.3.8.tar.xz.sig 12. https://downloads.powerdns.com/releases/pdns-recursor-5.4.3.tar.xz.sig 13. https://downloads.powerdns.com/releases/ 14. https://repo.powerdns.com/ 15. https://docs.powerdns.com/recursor/appendices/EOL.html

Today, we are releasing three new versions of the PowerDNS Authoritative Server. These 4.9.16, 5.0.6 and 5.1.2 versions provide fixes for the following PowerDNS Security Advisory: [1]PowerDNS Security Advisory 2026-07: Insufficient input validation of internal web server

Please make sure to read the [2]Upgrade Notes before upgrading.

The tarballs ([3]4.9.16, [4]5.0.6), [5]5.1.2) and their signatures ([6]4.9.16, [7]5.0.6), [8]5.1.2) are available at [9]downloads.powerdns.com. Packages for various distributions are available from [10]repo.powerdns.com.

Please send us all feedback and issues you might have via the [11]mailing list, or in case of a bug, via [12]GitHub.

References 2. https://doc.powerdns.com/authoritative/upgrading.html 3. https://downloads.powerdns.com/releases/pdns-4.9.16.tar.bz2 4. https://downloads.powerdns.com/releases/pdns-5.0.6.tar.bz2 5. https://downloads.powerdns.com/releases/pdns-5.1.2.tar.bz2 6. https://downloads.powerdns.com/releases/pdns-4.9.16.tar.bz2.sig 7. https://downloads.powerdns.com/releases/pdns-5.0.6.tar.bz2.sig 8. https://downloads.powerdns.com/releases/pdns-5.1.2.tar.bz2.sig 9. https://downloads.powerdns.com/releases/ 10. https://repo.powerdns.com/ 11. https://mailman.powerdns.com/mailman/listinfo/pdns-users 12. https://github.com/PowerDNS/pdns/issues/new/choose

On 5/22/26 00:31, ROI AI wrote: I understand the costs, but simply hanging all the dirty laundry out is counter productive.   Working a change in public without going into sensitive details is reasonable, but pushing vuln reports to public is careless.

[...]

As a further data point backing up this theory: We’re seeing duplicate reports of the same issue found by multiple independent groups that use LLMs, within the embargo period.

-- Jacob From: Jacob Bachmeyer <jcb62281 () gmail com> To: <oss-security () lists openwall com> Date: Thu, 21 May 2026 21:02:51 -0700 Subject: Re: [oss-security] Coordinated Disclosure in the LLM Age

On 5/21/26 01:51, ROI AI wrote: Also the entire nonsense about making the found issues public - this is absurd and just exacerbates the asymmetry problem.

By keeping the reports private, the OSS teams can deal with the issues more on their timeline.

By making them public, they add timeline pressure and enable attackers.

Why are you making it harder on yourself?  It is the opposite of what you want to do. security issues private rather seriously---and that itself has costs. any benefit when the issue was found using a tool to search for issues, due to the risk of someone else using the same tool and finding the same issue.  If that other person is another whitehat, you get a duplicate report.  If that other person is a blackhat, you get an in-the-wild exploit while you were carefully maintaining an embargo. [...]

From: ROI AI < mailto:sales () roiai ca > To: "oss-security"< mailto:oss-security () lists openwall com > Date: Wed, 20 May 2026 22:26:21 -0700 Subject: Re: [oss-security] Coordinated Disclosure in the LLM Age

People are shooting the messengers here.   The fact is - we are going through a generational security event due to the advancement of LLMs. amount of "AI" slop that has buried maintainers of major packages.  Have you forgotten already that curl had to cancel their bug bounty due to excessive "AI" slop submissions? It is also both trivial and extremely effective to use Agentic analysis to filter security reports. be incapable of precise analysis.  I understand talking your own book, but there are serious externalities here and I cannot let this go unanswered. genuine issue?  Now the issue does not get fixed... "AI" hallucinations?  Remember that the same hallucination-prone model might be doing the analysis as made the bogus report.  How, exactly, is a model supposed to recognize its own hallucinations? As for 'duplicates', people are claiming this when I have seen little evidence.  I reported a dozen or so to one major project and no one has yet claimed invalid or duplicate. manages inserting them into a bug tracker.  I am inclined to trust their experience over your hand-waving dismissal. in many projects, sent straight to the bit bucket, especially if found to be invalid.  You should not expect a response informing you that your report is invalid, as most maintainers have likely stopped bothering to send those. Moreover, if 'duplicates' are found, then that is a good signal for prioritization. issue may be "low-hanging fruit" and therefore already quasi-public.  In other words, duplicate reports could be a signal to dump the embargo and move faster to fix the issue.  (Remember that working under embargo has costs?  Those costs can extend the time to patch.) Let's stop talking about how the vulns are found and start fixing them with urgency. (< mailto:sales () roiai ca >) and realize that I am probably debating a slop machine tasked with promoting a product.  I will send this anyway, for the benefit of my fellow humans who will read this discussion and who might---just might---recognize your marketing efforts as the slop they are. ROI AI -- Jacob From: Alan Coopersmith < mailto: mailto:alan.coopersmith () oracle com > To: < mailto: mailto:oss-security () lists openwall com > Date: Wed, 20 May 2026 10:52:37 -0700 Subject: Re: [oss-security] Coordinated Disclosure in the LLM Age

On 4/28/26 07:58, Jeremy Stanley wrote: I'm sorely tempted, both due to the increased volume and the risk of premature disclosure, to just assume that any vulnerability reported as a result of research using an LLM is trivially discoverable by others, and give up trying to pretend there's any point to working it under embargo. Other maintainers under similar floods seem to agree:

Linux kernel: - https://lkml.org/lkml/2026/5/17/896 - https://docs.kernel.org/process/security-bugs.html

DNS servers (BIND, Unbound, PowerDNS): - https://indico.dns-oarc.net/event/56/contributions/1233/ - https://indico.dns-oarc.net/event/56/contributions/1233/attachments/1180/2539/presentation.pdf Confidential communication. No warranties or commitments unless in a signed agreement. If received in error, notify sender and delete. Unauthorized use prohibited.

Incorrect Behaviour of Views with TCP PROXY Requests

Concurrency and locking defects in GSS-TSIG

Insufficient Validation of Autoprimary SOA Queries

Insufficient Validation of Names During AXFR

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail

Also the entire nonsense about making the found issues public - this is absurd and just exacerbates the asymmetry problem.

By keeping the reports private, the OSS teams can deal with the issues more on their timeline.

By making them public, they add timeline pressure and enable attackers.

Why are you making it harder on yourself?  It is the opposite of what you want to do.

If it's giving CVE credit to people who've taken the time and tokens to report these issues that concerns you, than just bundle the issues in one CVE.

ROI AI

From: ROI AI <sales () roiai ca> To: "oss-security"<oss-security () lists openwall com> Date: Wed, 20 May 2026 22:26:21 -0700 Subject: Re: [oss-security] Coordinated Disclosure in the LLM Age

People are shooting the messengers here.   The fact is - we are going through a generational security event due to the advancement of LLMs.

It is also both trivial and extremely effective to use Agentic analysis to filter security reports.

As for 'duplicates', people are claiming this when I have seen little evidence.  I reported a dozen or so to one major project and no one has yet claimed invalid or duplicate.

Moreover, if 'duplicates' are found, then that is a good signal for prioritization.

Let's stop talking about how the vulns are found and start fixing them with urgency.

ROI AI

From: Alan Coopersmith < mailto:alan.coopersmith () oracle com > To: < mailto:oss-security () lists openwall com > Date: Wed, 20 May 2026 10:52:37 -0700 Subject: Re: [oss-security] Coordinated Disclosure in the LLM Age

On 4/28/26 07:58, Jeremy Stanley wrote: I'm sorely tempted, both due to the increased volume and the risk of premature disclosure, to just assume that any vulnerability reported as a result of research using an LLM is trivially discoverable by others, and give up trying to pretend there's any point to working it under embargo. Other maintainers under similar floods seem to agree: Linux kernel: - https://lkml.org/lkml/2026/5/17/896 - https://docs.kernel.org/process/security-bugs.html DNS servers (BIND, Unbound, PowerDNS): - https://indico.dns-oarc.net/event/56/contributions/1233/ - https://indico.dns-oarc.net/event/56/contributions/1233/attachments/1180/2539/presentation.pdf -- -Alan Coopersmith- mailto:alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris Confidential communication. No warranties or commitments unless in a signed agreement. If received in error, notify sender and delete. Unauthorized use prohibited.

On 4/28/26 07:58, Jeremy Stanley wrote: Other maintainers under similar floods seem to agree:

Linux kernel: - https://lkml.org/lkml/2026/5/17/896 - https://docs.kernel.org/process/security-bugs.html

DNS servers (BIND, Unbound, PowerDNS): - https://indico.dns-oarc.net/event/56/contributions/1233/ - https://indico.dns-oarc.net/event/56/contributions/1233/attachments/1180/2539/presentation.pdf

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Today, we are releasing two new versions of the PowerDNS Authoritative Server. These 4.9.15 and 5.0.5 versions provide fixes for the following PowerDNS Security Advisory: [1]PowerDNS Security Advisory 2026-06: Multiple Issues

The security issues being fixed with these releases are low or medium-severity, and most of them involve specific backends and/or configurations. They are: CVE-2026-41999 (only concerns 5.0.x) When using views, queries sent using TCP Proxy Protocol will select the view according to the address of the proxy, rather than the address of the initial query. This can lead to wrong data being returned. CVE-2026-42000 Missing escaping of special characters (such as $ or @) in DNS names received during an AXFR operation can lead to an incorrect (non-parseable) Bind backend configuration to be written, causing this backend to fail until manual operation is performed to fix the configuration. CVE-2026-42001 Missing sanity checks of the answer to the initial SOA query, when running in autosecondary mode and receiving a notification for an not-yet-known domain may cause the server to crash. CVE-2026-42002 Multiple concurrency and locking defects in the GSS-TSIG code can lead to memory corruption due to accidental data structure sharing, which can in turn lead to a program crash. Moreover, the lack of bounds on the number of in-flight GSS-TSIG contexts can lead to unbounded memory consumption in case of an excessive number of requests at a given time. A limit of 1000 contexts is now enforced, and can be modified with the “gss-max-contexts” parameter in server configuration. CVE-2026-42396 Missing proper escaping of double-quote characters when computing labels will cause AXFR of a catalog zone with a member whose producer group option contains such a character to fail.

Please make sure to read the [2]Upgrade Notes before upgrading.

The tarballs ([3]4.9.15, [4]5.0.5) and their signatures ([5]4.9.15, [6]5.0.5) are available at [7]downloads.powerdns.com. Packages for various distributions are available from [8]repo.powerdns.com.

Please send us all feedback and issues you might have via the [9]mailing list, or in case of a bug, via [10]GitHub.

References 2. https://doc.powerdns.com/authoritative/upgrading.html 3. https://downloads.powerdns.com/releases/pdns-4.9.15.tar.bz2 4. https://downloads.powerdns.com/releases/pdns-5.0.5.tar.bz2 5. https://downloads.powerdns.com/releases/pdns-4.9.15.tar.bz2.sig 6. https://downloads.powerdns.com/releases/pdns-5.0.5.tar.bz2.sig 7. https://downloads.powerdns.com/releases/ 8. https://repo.powerdns.com/ 9. https://mailman.powerdns.com/mailman/listinfo/pdns-users 10. https://github.com/PowerDNS/pdns/issues/new/choose

Today, we are releasing two new versions of the PowerDNS Authoritative Server. These 4.9.14 and 5.0.4 versions provide fixes for the following PowerDNS Security Advisory: [1]PowerDNS Security Advisory 2026-05: Multiple Issues

The security issues being fixed with these releases are low or medium-severity, and most of them involve specific backends and/or configurations. They are: CVE-2026-33257 An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The web server is disabled and restricted by an ACL by default. CVE-2026-33260 An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The web server is disabled and restricted by an ACL by default. CVE-2026-33608 Incomplete domain name sanitization may cause the bind backend to be rendered unusable when running in autosecondary mode. CVE-2026-33609 Incomplete escaping of LDAP queries when running with 8bit-dns may cause wrong results to be returned. CVE-2026-33610 A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it. CVE-2026-33611 Adding ill-formed HTTP or SVCB records from the API or through pdnsutil can lead to permanent LMDB database corruption.

Please make sure to read the [2]Upgrade Notes before upgrading.

The tarballs ([3]4.9.14, [4]5.0.4) and their signatures ([5]4.9.14, [6]5.0.4) are available at [7]downloads.powerdns.com. Packages for various distributions are available from [8]repo.powerdns.com.

Please send us all feedback and issues you might have via the [9]mailing list, or in case of a bug, via [10]GitHub.

References 2. https://doc.powerdns.com/authoritative/upgrading.html 3. https://downloads.powerdns.com/releases/pdns-4.9.14.tar.bz2 4. https://downloads.powerdns.com/releases/pdns-5.0.4.tar.bz2 5. https://downloads.powerdns.com/releases/pdns-4.9.14.tar.bz2.sig 6. https://downloads.powerdns.com/releases/pdns-5.0.4.tar.bz2.sig 7. https://downloads.powerdns.com/releases/ 8. https://repo.powerdns.com/ 9. https://mailman.powerdns.com/mailman/listinfo/pdns-users 10. https://github.com/PowerDNS/pdns/issues/new/choose

We have released PowerDNS Recursor 5.2.9, 5.3.6 and 5.4.1.

These releases provide fixes for PowerDNS Security Advisory

2026-03 for PowerDNS Recursor: Multiple issues

There are several CVEs associated with this advisory, all of severity Medium.

CVE-2026-33256 Unbounded memory allocation by internal web server, affected 5.3.5, 5.4.0 CVE-2026-33257 Insufficient input validation of internal web server, affected 5.2.8 CVE-2026-33258 Crafted zones can cause increased resource usage, affected 5.2.8, 5.3.5, 5.4.0 CVE-2026-33259 Concurrent modification of RPZ data can lead to denial of service, affected 5.2.8 5.3.5, 5.4.0 CVE-2026-33260 Insufficient input validation of internal web server, affected 5.2.8 CVE-2026-33261 Null pointer access in aggressive NSEC(3) cache, affected 5.2.8, 5.3.5, 5.4.0 CVE-2026-33262 Insufficient validation of cookie reply, affected 5.4.0 CVE-2026-33601 Insufficient validation of ZONEMD record, affected 5.2.8, 5.3.5, 5.4.0 CVE-2026-33600 Null pointer dereference in RPZ transfer, affected 5.2.8, 5.3.5, 5.4.0

Please refer to the changelogs (5.2.9[1], 5.3.6[2] and 5.4.1[3]) and the full security advisory[4] for additional details.

Please send us all feedback and issues you might have via the mailing list[5], or in case of a bug, via GitHub[6].

The tarballs (5.2.9[7], 5.3.6[8], 5.4.1[9]) (with signature files 5.2.9[10], 5.3.6[11], 5.4.1[12]) are available from our download server[13] and packages for several distributions are available from our repository[14].

Recently we made changes to our Open Source End of Life policy. Older release trains are now supported for one year after the following major release. Consult the EOL policy[15] for more details.

We are grateful to the PowerDNS community for the reporting of bugs, issues, feature requests, and especially to the submitters of fixes and implementations of features.

References

1. https://doc.powerdns.com/recursor/changelog/5.2.html#change-5.2.9 2. https://doc.powerdns.com/recursor/changelog/5.3.html#change-5.3.6 3. https://doc.powerdns.com/recursor/changelog/5.4.html#change-5.4.1 4. https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-03.html 5. https://mailman.powerdns.com/mailman/listinfo/pdns-users 6. https://github.com/PowerDNS/pdns/issues/new/choose 7. https://downloads.powerdns.com/releases/pdns-recursor-5.2.9.tar.bz2 8. https://downloads.powerdns.com/releases/pdns-recursor-5.3.6.tar.xz 9. https://downloads.powerdns.com/releases/pdns-recursor-5.4.1.tar.xz 10. https://downloads.powerdns.com/releases/pdns-recursor-5.2.9.tar.bz2.sig 11. https://downloads.powerdns.com/releases/pdns-recursor-5.3.6.tar.xz.sig 12. https://downloads.powerdns.com/releases/pdns-recursor-5.4.1.tar.xz.sig 13. https://downloads.powerdns.com/releases/ 14. https://repo.powerdns.com/ 15. https://docs.powerdns.com/recursor/appendices/EOL.html

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend.

A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.

Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.

A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.

A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

PRSD detection denial of service

A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend.

A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.

A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or autoupgrade (YAML) settings. DDR upgrade is not enabled by default.

A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.

An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.

An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default.