# Powerdns Recursor vulnerabilities Source: https://junglewise.ai/threats/technologies/recursor Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/recursor.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in Powerdns Recursor: 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-52688, was published on 23 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 19 (0 critical, 0 exploited in the wild) ## About Powerdns Recursor A high-end, high-performance resolving name server that utilizes multiple threads and features a Lua scripting interface. ## Latest Powerdns Recursor vulnerabilities - [CVE-2026-52688: PowerDNS Recursor DNSSEC wildcard validation bypass in RRSIG processing](https://junglewise.ai/threats/cve-2026-52688-powerdns-recursor-dnssec-wildcard-validation-bypass-in-rrsig) (high, CVSS 7.5, published 23 Jul 2026) - [CVE-2026-52686: PowerDNS Recursor DNSSEC validation bypass in wildcard CNAME/DNAME records](https://junglewise.ai/threats/cve-2026-52686-powerdns-recursor-dnssec-validation-bypass-in-wildcard-cname) (low, CVSS 3.7, published 23 Jul 2026) - [CVE-2026-52684: PowerDNS Recursor TTL capping bypass in NS record refresh](https://junglewise.ai/threats/cve-2026-52684-powerdns-recursor-ttl-capping-bypass-in-ns-record-refresh) (low, CVSS 3.7, published 23 Jul 2026) - [CVE-2026-52690: PowerDNS Recursor DNSSEC validation failure via EDNS spoofing](https://junglewise.ai/threats/cve-2026-52690-powerdns-recursor-dnssec-validation-failure-via-edns-spoofing) (medium, CVSS 5.9, published 25 Jun 2026) - [CVE-2026-42390: PowerDNS Recursor improper ZONEMD validation in ZoneToCache](https://junglewise.ai/threats/cve-2026-42390-powerdns-recursor-improper-zonemd-validation-in-zonetocache) (medium, CVSS 5.3, published 25 Jun 2026) - [CVE-2026-42389: PowerDNS Recursor insufficient validation of authoritative answers](https://junglewise.ai/threats/cve-2026-42389-powerdns-recursor-insufficient-validation-of-authoritative) (medium, CVSS 5.3, published 25 Jun 2026) - [CVE-2026-42388: PowerDNS Recursor denial of service in Catalog Zones](https://junglewise.ai/threats/cve-2026-42388-powerdns-recursor-denial-of-service-in-catalog-zones) (medium, CVSS 5.9, published 25 Jun 2026) - [CVE-2026-42387: PowerDNS Recursor denial of service in ZoneToCache](https://junglewise.ai/threats/cve-2026-42387-powerdns-recursor-denial-of-service-in-zonetocache) (medium, CVSS 5.9, published 25 Jun 2026) - [CVE-2026-40012: PowerDNS Recursor incorrect caching of ECS zero-scoped answers](https://junglewise.ai/threats/cve-2026-40012-powerdns-recursor-incorrect-caching-of-ecs-zero-scoped-answers) (medium, CVSS 5.3, published 25 Jun 2026) - [CVE-2026-33612: PowerDNS Recursor cache poisoning in ZoneToCache function](https://junglewise.ai/threats/cve-2026-33612-powerdns-recursor-cache-poisoning-in-zonetocache-function) (high, CVSS 7.5, published 25 Jun 2026) - [CVE-2026-33601: If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in…](https://junglewise.ai/threats/cve-2026-33601-if-you-use-the-zonetocache-function-with-a-malicious) (medium, CVSS 4.4, published 22 Apr 2026) - [CVE-2026-33600: An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing…](https://junglewise.ai/threats/cve-2026-33600-an-rpz-sent-by-a-malicious-authoritative-server-can-result-in-a) (medium, CVSS 4.4, published 22 Apr 2026) - [CVE-2026-33262: An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and…](https://junglewise.ai/threats/cve-2026-33262-an-attacker-can-send-replies-that-result-in-a-null-pointer) (medium, CVSS 5.9, published 22 Apr 2026) - [CVE-2026-33261: A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.](https://junglewise.ai/threats/cve-2026-33261-a-zone-transition-from-nsec-to-nsec3-might-trigger-an-internal) (medium, CVSS 5.9, published 22 Apr 2026) - [CVE-2026-33260: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33260-an-attacker-can-send-a-web-request-that-causes-unlimited-memory) (medium, CVSS 5.3, published 22 Apr 2026) - [CVE-2026-33259: Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of…](https://junglewise.ai/threats/cve-2026-33259-having-many-concurrent-transfers-of-the-same-rpz-can-lead-to) (medium, CVSS 5, published 22 Apr 2026) - [CVE-2026-33258: By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive…](https://junglewise.ai/threats/cve-2026-33258-by-publishing-and-querying-a-crafted-zone-an-attacker-can-cause) (medium, CVSS 5.3, published 22 Apr 2026) - [CVE-2026-33257: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33257-an-attacker-can-send-a-web-request-that-causes-unlimited-memory) (medium, CVSS 5.3, published 22 Apr 2026) - [CVE-2026-33256: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33256-an-attacker-can-send-a-web-request-that-causes-unlimited-memory) (medium, CVSS 5.3, published 22 Apr 2026) ## Most severe Powerdns Recursor vulnerabilities - [CVE-2026-52688: PowerDNS Recursor DNSSEC wildcard validation bypass in RRSIG processing](https://junglewise.ai/threats/cve-2026-52688-powerdns-recursor-dnssec-wildcard-validation-bypass-in-rrsig) (high, CVSS 7.5, published 23 Jul 2026) - [CVE-2026-33612: PowerDNS Recursor cache poisoning in ZoneToCache function](https://junglewise.ai/threats/cve-2026-33612-powerdns-recursor-cache-poisoning-in-zonetocache-function) (high, CVSS 7.5, published 25 Jun 2026) - [CVE-2026-33262: An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and…](https://junglewise.ai/threats/cve-2026-33262-an-attacker-can-send-replies-that-result-in-a-null-pointer) (medium, CVSS 5.9, published 22 Apr 2026) - [CVE-2026-33261: A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.](https://junglewise.ai/threats/cve-2026-33261-a-zone-transition-from-nsec-to-nsec3-might-trigger-an-internal) (medium, CVSS 5.9, published 22 Apr 2026) - [CVE-2026-52690: PowerDNS Recursor DNSSEC validation failure via EDNS spoofing](https://junglewise.ai/threats/cve-2026-52690-powerdns-recursor-dnssec-validation-failure-via-edns-spoofing) (medium, CVSS 5.9, published 25 Jun 2026) - [CVE-2026-42388: PowerDNS Recursor denial of service in Catalog Zones](https://junglewise.ai/threats/cve-2026-42388-powerdns-recursor-denial-of-service-in-catalog-zones) (medium, CVSS 5.9, published 25 Jun 2026) - [CVE-2026-42387: PowerDNS Recursor denial of service in ZoneToCache](https://junglewise.ai/threats/cve-2026-42387-powerdns-recursor-denial-of-service-in-zonetocache) (medium, CVSS 5.9, published 25 Jun 2026) - [CVE-2026-33256: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33256-an-attacker-can-send-a-web-request-that-causes-unlimited-memory) (medium, CVSS 5.3, published 22 Apr 2026) - [CVE-2026-33258: By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive…](https://junglewise.ai/threats/cve-2026-33258-by-publishing-and-querying-a-crafted-zone-an-attacker-can-cause) (medium, CVSS 5.3, published 22 Apr 2026) - [CVE-2026-33260: An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a…](https://junglewise.ai/threats/cve-2026-33260-an-attacker-can-send-a-web-request-that-causes-unlimited-memory) (medium, CVSS 5.3, published 22 Apr 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Powerdns technologies - [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist): 24 vulnerabilities - [PowerDNS Authoritative Server](https://junglewise.ai/threats/technologies/authoritative-server): 7 vulnerabilities - [Powerdns Authoritative](https://junglewise.ai/threats/technologies/authoritative): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Powerdns Recursor vulnerabilities", https://junglewise.ai/threats/technologies/recursor, 9 November 2026.