Product by Open Source
Powerdns
17 known vulnerabilities in Powerdns (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
17
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-24028 | Out-of-bounds read when parsing DNS packets via Lua | 5.3 | |
| High | CVE-2026-33256 | Unbounded memory allocation by internal web server | 7.5 | |
| High | CVE-2026-33258 | Crafted zones can cause increased resource usage | 7.5 | |
| High | CVE-2026-33260 | Insufficient input validation of internal webserver | 7.5 | |
| High | CVE-2026-33257 | Insufficient input validation of internal webserver | 7.5 | |
| Medium | CVE-2026-119658 | PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update | 4.3 | |
| High | CVE-2026-27853 | Out-of-bounds write when rewriting large DNS packets | 5.9 | |
| High | CVE-2026-24030 | Unbounded memory allocation for DoQ and DoH3 | 5.3 | |
| Medium | CVE-2026-33600 | Null pointer dereference in RPZ transfer | 4.9 | |
| Medium | CVE-2026-33262 | Insufficient validation of cookie reply | 5.9 | |
| Medium | CVE-2026-33601 | Insufficient validation of zonemd record | 4.9 | |
| High | CVE-2026-27854 | Use after free when parsing EDNS options in Lua | 4.8 | |
| Medium | CVE-2026-24029 | DNS over HTTPS ACL bypass | 6.5 | |
| Medium | CVE-2026-33261 | Null pointer accces in aggressive NSEC(3) cache | 5.9 | |
| Medium | CVE-2026-33259 | Concurrent modification of RPZ data can lead to denial of servce | 5.0 | |
| Medium | CVE-2026-0397 | Information disclosure via CORS misconfiguration | 3.1 | |
| Medium | CVE-2026-0396 | HTML injection in the web dashboard | 3.1 |