# Powerdns vulnerabilities Source: https://junglewise.ai/threats/vendors/powerdns Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 01:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/powerdns.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 53 vulnerabilities in Powerdns: 1 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125378, was published on 10 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. 4 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 2 - Last 90 days: 2 - All time: 53 (0 critical, 0 exploited in the wild) ## About Powerdns An open-source provider of DNS software and services. ## Latest Powerdns vulnerabilities - [CVE-2026-125378: PowerDNS-Admin missing authorization in template records handler](https://junglewise.ai/threats/cve-2026-125378-powerdns-admin-before-2026-11-0-contains-a-missing-authorization) (medium, CVSS 4.3, published 10 Nov 2026) - [CVE-2026-119658: PowerDNS-Admin authorization bypass in secondary zone refresh](https://junglewise.ai/threats/cve-2026-119658-powerdns-admin-through-2026-08-1-contains-an-authorization) (medium, CVSS 4.3, published 30 Oct 2026) - [CVE-2026-52688: PowerDNS Recursor DNSSEC wildcard validation bypass in RRSIG processing](https://junglewise.ai/threats/cve-2026-52688-powerdns-recursor-dnssec-wildcard-validation-bypass-in-rrsig) (high, CVSS 7.5, published 23 Jul 2026) - [CVE-2026-52686: PowerDNS Recursor DNSSEC validation bypass in wildcard CNAME/DNAME records](https://junglewise.ai/threats/cve-2026-52686-powerdns-recursor-dnssec-validation-bypass-in-wildcard-cname) (low, CVSS 3.7, published 23 Jul 2026) - [CVE-2026-52684: PowerDNS Recursor TTL capping bypass in NS record refresh](https://junglewise.ai/threats/cve-2026-52684-powerdns-recursor-ttl-capping-bypass-in-ns-record-refresh) (low, CVSS 3.7, published 23 Jul 2026) - [CVE-2026-52690: PowerDNS Recursor DNSSEC validation failure via EDNS spoofing](https://junglewise.ai/threats/cve-2026-52690-powerdns-recursor-dnssec-validation-failure-via-edns-spoofing) (medium, CVSS 5.9, published 25 Jun 2026) - [CVE-2026-42390: PowerDNS Recursor improper ZONEMD validation in ZoneToCache](https://junglewise.ai/threats/cve-2026-42390-powerdns-recursor-improper-zonemd-validation-in-zonetocache) (medium, CVSS 5.3, published 25 Jun 2026) - [CVE-2026-42389: PowerDNS Recursor insufficient validation of authoritative answers](https://junglewise.ai/threats/cve-2026-42389-powerdns-recursor-insufficient-validation-of-authoritative) (medium, CVSS 5.3, published 25 Jun 2026) - [CVE-2026-42388: PowerDNS Recursor denial of service in Catalog Zones](https://junglewise.ai/threats/cve-2026-42388-powerdns-recursor-denial-of-service-in-catalog-zones) (medium, CVSS 5.9, published 25 Jun 2026) - [CVE-2026-42387: PowerDNS Recursor denial of service in ZoneToCache](https://junglewise.ai/threats/cve-2026-42387-powerdns-recursor-denial-of-service-in-zonetocache) (medium, CVSS 5.9, published 25 Jun 2026) - [CVE-2026-40012: PowerDNS Recursor incorrect caching of ECS zero-scoped answers](https://junglewise.ai/threats/cve-2026-40012-powerdns-recursor-incorrect-caching-of-ecs-zero-scoped-answers) (medium, CVSS 5.3, published 25 Jun 2026) - [CVE-2026-42004: PowerDNS DNSdist EDNS options smuggling in EDNS processing](https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing) (low, CVSS 3.7, published 25 Jun 2026) - [CVE-2026-40211: PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3) (medium, CVSS 5.3, published 25 Jun 2026) - [CVE-2026-40210: PowerDNS DNSdist out-of-bounds read in SetMacAddrAction](https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction) (medium, CVSS 4.8, published 25 Jun 2026) - [CVE-2026-40209: PowerDNS DNSdist denial of service via IXFR queries](https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries) (medium, CVSS 5.3, published 25 Jun 2026) - [CVE-2026-40208: PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries) (low, CVSS 3.7, published 25 Jun 2026) - [CVE-2026-40011: PowerDNS DNSdist denial of service in Prometheus endpoint](https://junglewise.ai/threats/cve-2026-40011-powerdns-dnsdist-denial-of-service-in-prometheus-endpoint) (low, CVSS 3.7, published 25 Jun 2026) - [CVE-2026-33612: PowerDNS Recursor cache poisoning in ZoneToCache function](https://junglewise.ai/threats/cve-2026-33612-powerdns-recursor-cache-poisoning-in-zonetocache-function) (high, CVSS 7.5, published 25 Jun 2026) - [CVE-2026-42005: PowerDNS Authoritative Server denial of service in internal web server](https://junglewise.ai/threats/cve-2026-42005-powerdns-authoritative-server-denial-of-service-in-internal-web) (medium, CVSS 4.3, published 25 Jun 2026) - [CVE-2026-42396: PowerDNS Authoritative Server denial of service in catalog zone transfer](https://junglewise.ai/threats/cve-2026-42396-powerdns-authoritative-server-denial-of-service-in-catalog-zone) (medium, CVSS 4.9, published 21 May 2026) - [CVE-2026-42002: PowerDNS Authoritative Server denial of service in GSS-TSIG](https://junglewise.ai/threats/cve-2026-42002-powerdns-authoritative-server-denial-of-service-in-gss-tsig) (medium, CVSS 5.9, published 21 May 2026) - [CVE-2026-42001: PowerDNS Authoritative Server insufficient validation of Autoprimary SOA queries](https://junglewise.ai/threats/cve-2026-42001-powerdns-authoritative-server-insufficient-validation-of) (high, CVSS 7.5, published 21 May 2026) - [CVE-2026-42000: PowerDNS Authoritative Server insufficient name validation in AXFR](https://junglewise.ai/threats/cve-2026-42000-powerdns-authoritative-server-insufficient-name-validation-in) (medium, CVSS 6.8, published 21 May 2026) - [CVE-2026-41999: PowerDNS Authoritative Server incorrect view handling with TCP PROXY](https://junglewise.ai/threats/cve-2026-41999-powerdns-authoritative-server-incorrect-view-handling-with-tcp) (medium, CVSS 4.8, published 21 May 2026) - [CVE-2026-33611: PowerDNS Authoritative Server database corruption via REST API](https://junglewise.ai/threats/cve-2026-33611-powerdns-authoritative-server-database-corruption-via-rest-api) (medium, CVSS 6.5, published 22 Apr 2026) ## Most severe Powerdns vulnerabilities - [CVE-2026-33593: A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.](https://junglewise.ai/threats/cve-2026-33593-a-client-can-trigger-a-divide-by-zero-error-leading-to-crash-by) (high, CVSS 7.5, published 22 Apr 2026) - [CVE-2026-52688: PowerDNS Recursor DNSSEC wildcard validation bypass in RRSIG processing](https://junglewise.ai/threats/cve-2026-52688-powerdns-recursor-dnssec-wildcard-validation-bypass-in-rrsig) (high, CVSS 7.5, published 23 Jul 2026) - [CVE-2026-33612: PowerDNS Recursor cache poisoning in ZoneToCache function](https://junglewise.ai/threats/cve-2026-33612-powerdns-recursor-cache-poisoning-in-zonetocache-function) (high, CVSS 7.5, published 25 Jun 2026) - [CVE-2026-42001: PowerDNS Authoritative Server insufficient validation of Autoprimary SOA queries](https://junglewise.ai/threats/cve-2026-42001-powerdns-authoritative-server-insufficient-validation-of) (high, CVSS 7.5, published 21 May 2026) - [CVE-2026-33608: An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes…](https://junglewise.ai/threats/cve-2026-33608-an-attacker-can-send-a-notify-request-that-causes-a-new-secondary) (high, CVSS 7.4, published 22 Apr 2026) - [CVE-2026-42000: PowerDNS Authoritative Server insufficient name validation in AXFR](https://junglewise.ai/threats/cve-2026-42000-powerdns-authoritative-server-insufficient-name-validation-in) (medium, CVSS 6.8, published 21 May 2026) - [CVE-2026-33602: A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value…](https://junglewise.ai/threats/cve-2026-33602-a-rogue-backend-can-send-a-crafted-udp-response-with-a-query-id) (medium, CVSS 6.5, published 22 Apr 2026) - [CVE-2026-24029: PowerDNS DNSdist ACL bypass in DNS over HTTPS frontend](https://junglewise.ai/threats/cve-2026-24029-powerdns-dnsdist-acl-bypass-in-dns-over-https-frontend) (medium, CVSS 6.5, published 31 Mar 2026) - [CVE-2026-33611: PowerDNS Authoritative Server database corruption via REST API](https://junglewise.ai/threats/cve-2026-33611-powerdns-authoritative-server-database-corruption-via-rest-api) (medium, CVSS 6.5, published 22 Apr 2026) - [CVE-2026-27853: PowerDNS DNSdist out-of-bounds write in changeName Lua methods](https://junglewise.ai/threats/cve-2026-27853-powerdns-dnsdist-out-of-bounds-write-in-changename-lua-methods) (medium, CVSS 5.9, published 31 Mar 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Powerdns technologies - [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist): 24 vulnerabilities - [Powerdns Recursor](https://junglewise.ai/threats/technologies/recursor): 19 vulnerabilities - [PowerDNS Authoritative Server](https://junglewise.ai/threats/technologies/authoritative-server): 7 vulnerabilities - [Powerdns Authoritative](https://junglewise.ai/threats/technologies/authoritative): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Powerdns vulnerabilities", https://junglewise.ai/threats/vendors/powerdns, 10 November 2026.