Description
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pdns | 3.4.4-1 | — |
| Debian 14 | pdns-recursor | 3.7.2-1 | — |
| Debian 13 | pdns | 3.4.4-1 | — |
| Debian 13 | pdns-recursor | 3.7.2-1 | — |
| Debian 12 | pdns | 3.4.4-1 | — |
| Debian 12 | pdns-recursor | 3.7.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | pdns | 3.3-2ubuntu0.1 | — |
| Ubuntu 14.04 LTS | pdns-recursor | 3.5.3-1ubuntu0.1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pdns | 4.0.1-1.2 | openSUSE-SU-2024:10136-1 |
| openSUSE Tumbleweed | pdns-recursor | 4.0.3-1.2 | openSUSE-SU-2024:10537-1 |
Advisories 2
- openSUSE-SU-2024:10136-1 pdns-4.0.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10537-1 pdns-recursor-4.0.3-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- FEDORA-2015-7079 vendor-advisory
- FEDORA-2015-7031 vendor-advisory
- FEDORA-2015-7018 vendor-advisory
- 74306 vdb-entry
- FEDORA-2015-7033 vendor-advisory
- FEDORA-2015-7047 vendor-advisory
- DSA-3306 vendor-advisory
- DSA-3307 vendor-advisory
- 1032220 vdb-entry
- FEDORA-2015-7057 vendor-advisory