PT-2024-10518 · Powerdns+2 · Powerdns Recursor+2

Toshifumi Sakaguchi · Published 2024-10-03 · Updated 2025-08-14 · CVE-2024-25590

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PowerDNS Recursor versions prior to 4.9.9 PowerDNS Recursor versions prior to 5.0.9 PowerDNS Recursor versions prior to 5.1.2

Description An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can lead to a denial of service. The issue is related to insufficient input validation in the PowerDNS Recursor.

Recommendations For PowerDNS Recursor versions prior to 4.9.9, update to version 4.9.9 or later. For PowerDNS Recursor versions prior to 5.0.9, update to version 5.0.9 or later. For PowerDNS Recursor versions prior to 5.1.2, update to version 5.1.2 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-01069

CVE-2024-25590

DSA-5852-1

OPENSUSE-SU-2024:14462-1

Affected Products

Debian

Powerdns Recursor

Red Os

References · 24

• https://osv.dev/vulnerability/DSA-5852-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25590 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-25590 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-25590 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14462-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25590 · Security Note
• https://bdu.fstec.ru/vul/2025-01069 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-25590 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-25590 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-25590 · Vendor Advisory
• https://github.com/PowerDNS/pdns/pull/14744 · Note
• http://openwall.com/lists/oss-security/2024/10/03/3 · Note
• https://twitter.com/oss_security/status/1841890014705111419 · Twitter Post
• https://suse.com/security/cve/CVE-2024-25590 · Note