PowerDNS Recursor

Deterred spoofing attempts can lead to authoritative servers being marked unavailable

Crafted zones can lead to increased incoming network traffic

Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor

Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor

PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance degradations") via a large or infinite number of referrals, as demonstrated by resolving domains hosted by ezdns.it.

PowerDNS Recursor 3.1.3 and earlier allows remote attackers to cause a denial of service (resource exhaustion and application crash) via a CNAME record with a zero TTL, which triggers an infinite loop.

Concurrent modification of RPZ data can lead to denial of servce

Null pointer dereference in RPZ transfer

Insufficient validation of zonemd record

Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.