PowerDNS Recursor is vulnerable to denial of service attacks caused by null pointer dereferences due to missing consistency checks.

🚨 EUVD-2026-24727 📊 Score: 5.9/10 (CVSS v3.1) 📦 Product: Recursor, Recursor, Recursor 🏢 Vendor: PowerDNS 📅 Updated: 2026-04-22 📝 A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24727 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24729 📊 Score: 5.9/10 (CVSS v3.1) 📦 Product: Recursor, Recursor, Recursor 🏢 Vendor: PowerDNS 📅 Updated: 2026-04-22 📝 An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24729 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24731 📊 Score: 4.4/10 (CVSS v3.1) 📦 Product: Recursor, Recursor, Recursor 🏢 Vendor: PowerDNS 📅 Updated: 2026-04-22 📝 An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24731 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24733 📊 Score: 4.4/10 (CVSS v3.1) 📦 Product: Recursor, Recursor, Recursor 🏢 Vendor: PowerDNS 📅 Updated: 2026-04-22 📝 If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24733 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24719 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: Recursor, Recursor, Recursor 🏢 Vendor: PowerDNS 📅 Updated: 2026-04-22 📝 An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24719 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24720 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: dnsdist, Authoritative, Recursor (+4 more) 🏢 Vendor: PowerDNS 📅 Updated: 2026-04-22 📝 An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24720 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24721 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: Recursor, Recursor, Recursor 🏢 Vendor: PowerDNS 📅 Updated: 2026-04-22 📝 By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24721 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24723 📊 Score: 5.0/10 (CVSS v3.1) 📦 Product: Recursor, Recursor, Recursor 🏢 Vendor: PowerDNS 📅 Updated: 2026-04-22 📝 Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24723 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24725 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: Authoritative, Recursor, dnsdist (+4 more) 🏢 Vendor: PowerDNS 📅 Updated: 2026-04-22 📝 An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24725 #cybersecurity #infosec #euvd #cve #vulnerability