Executive brief
PowerDNS Recursor, a tool used by internet service providers to look up website addresses, contains a minor flaw in how it handles expiring records. Under specific conditions involving very slow network responses, the system may fail to properly limit the 'Time to Live' (TTL) for certain internal records. This could lead to records staying in the system's memory longer than intended, though it does not pose a significant risk to data security or service availability.
Technical details
A vulnerability in PowerDNS Recursor versions prior to 5.5.0 occurs within the 'refresh-almost-expired' logic. When the recursor attempts to refresh authoritative NS records that are nearing expiration, a race condition can occur if the authoritative server responds very slowly. If the records expire while the recursor is waiting for the response, the lack of valid data prevents the enforcement of TTL capping. This issue is specific to the background refresh mechanism and does not affect standard resolution paths. An attacker cannot easily trigger this, as it relies on specific timing and upstream latency. The issue is addressed in version 5.5.0 by disabling NS record refreshes in the 'refresh-almost-expired' component.
Affected products
- PowerDNS Recursor < 5.5.0
Timeline
- 2026-07-20: patched: Pull request merged into master branch
- 2026-07-23: disclosed: CVE published